Verification codes

To allow for the possibility that an unauthorized individual has signed into your account, you can Check your Apple ID device list  (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.

If there are none that shouldn’t be signed in, then you should not have a problem at this point. But, if an unauthorized device is signed in, Change your Apple ID password https://support.apple.com/en-us/HT201355 

Here is What to do after you change your Apple ID or password https://support.apple.com/en-us/HT204071

Someone may be trying to sign your Apple ID, which would generate the request for a verification code. Since you have 2 Factor Authentication enabled, as long as they can't access one of your trusted devices, they can't get a code, and sign in. You should be okay.