What the customer demands here seems to be a bit unreasonable. Singapore Airlines is protecting the accounts with a 6-digit PIN code and in order to prevent fraud, sends e-mails for any kind of transaction (including adding redemption nominees). She would have received six e-mails in total: three for adding three people and then three ticket confirmations.
Most likely she gave her 6-digit PIN code away by answering to a phishing e-mail. A bit of common sense applies here as well.
Her suggested solution would cost SQ a lot of money as they have to pay for each and every OTP generated. Banks (where OTP are commonly used) are now moving to Apps producing this OTP free of cost and this is something SQ could consider but then I think that the e-mail notification in itself is more than sufficient.