Flood control?

I am not sure if I understand your question correctly.

Flood control?

Yes, this module comes with the flood control measure to prevent brute-force attack.

Is there anything that would stop someone from creating an account with someone else's email

This is a question to Drupal core. Since Drupal will set the password reset link to user's email, if this happen, then that is a security question to core. As Drupal security policy, I won't discuss this question here.

I tried it out leaving the code field empty and eventually I got "Failed validation limit reached." I don't know if there's a way around that.

Bypass the flood control is a security breach, so the short answer is no, you can't.

Just wondering if this is a topic that has come up, either for this module or for the TFA plugins generally.

I don't understand what you want to ask here.

Close it as I think all questions related to this module have been answered.