Sheesh!
The 'already logged in to another account' is a common problem I encounter. It's BA IT not working right - it's a cookie management issue - very poor.
They need to fix that before they move on to "two factor authentication" - ie send you a message with a code on e-mail or phone.
Sending the code to the wrong phone is quite a serious failure too - not catastrophic, but should be raised with them as a security issue.