Wouldnt you have gotten unexpected 2fa notifications if that were the case?
For either method, you can audit the activity of your account on the GitHub security page: https://github.com/settings/security. For example, upon having deliberately got my 2FA token wrong, "user.two_factor_requested" and "user.failed_login" events were logged for me.
I'm gonna change my password just in case.