Did you recently log into devices that are connected to your Apple ID and you had to fill in the Two-Factor Authentication code, that has been sent to you?
This can happen, if you use your browser to access your iCloud account on your computer, for example.
In that case you will also be notified via mail from Apple, that one of your devices has been used to access your iCloud account.
This might also be phishing messages:
Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support