If a user who is enrolled in two-step verification (2SV) is unable to authenticate and has lost their recovery codes, the only way they can regain access to Bitbucket is if an admin deletes their 2SV enrollment via REST API. 

It would be more ideal for admins to have the ability to clear a 2SV user enrollment via the UI (similar to resetting CAPTCHA for a user who is blocked, a button appears on the user profile for admins).