Disabling their account or altering their first factor makes the second factor irrelevant. Who cares if I have a TOTP code for my old account, if the account is deactivated and/or its password changed?