Currently, when a user initiates a two-step verification recovery, we first send a recovery request notice email, followed by another email with a recovery link in 24 hours.

Within this 24 hours interval, if the user login to bitbucket.org, the recovery request that was in progress will be cancelled/reset. But the user will not receive any email notification for this. It'd be better to be notified of this change so users will know the status of the request.