I used the address* provided by Traitor7402 above and sent a message asking for my 2FA to be reset.

Three days later I got a message telling me that this had been done. I then encountered a few "Bad request" pages and had to lower my standard browser security settings signifcantly to proceed to a page that generated a "2FA reset" email message and started the new MFA process.

I can now log in to my BAEC account. But I have no idea why the 2FA broke in the first place (it just stopped accepting OTPs from the generator I'd registered and also rejected my recovery key) or how long it will work this time.

* britishairways.com/travel/feedbackclaims/public/en_gb/select/avi