Can two requested codes both remain valid?

Do not assume so; use the newest unexpired code.

What helps locate a lock?

The account identifier, timestamp and exact error message.

CHECK 01

Confirm the registered identifier before changing a password that may still be correct.

CHECK 02

One-time codes expire and a newer request can invalidate the previous message.

CHECK 03

Confirm inbox filtering, phone prefix, device time and network access without publishing the code.

CHECK 04

Send the time, route and exact message to support; never include the password or full security answer.

Can two requested codes both remain valid?: Do not assume so; use the newest unexpired code.
Should the password be sent to support?: No.
What helps locate a lock?: The account identifier, timestamp and exact error message.