The method JFactory::getApplication()->login() call $authenticate->authenticate($credentials, $options), this call the plugin one of enable authentication with event onUserAuthenticate. In there it call the onUserTwofactorAuthenticate event related to TwoFactor plugin, in there it checks if secret key is valid or not