They're sending out codes, which means that whether or not it's account locked their servers will have to verify that your phone has used a valid code.

I can think of a couple ways around it but both are extremely improbable or impossible or just a massive red flag.

Someone could leak their code assuming it's not a one time use, but hundreds or thousands of phones suddenly using the same code would set every alarm off imaginable and likely result in that person being removed from the beta completely.

Was going to make this second part more technical and specific but that would be a headache to try and type up while accounting for every variation of how it may or may not work depending on the quality of their security. The short answer is trying to crack the apk to connect to their servers would be extremely difficult if not impossible and would almost definitely get detected shortly and would probably result in bans.