I had this happen to me, a person with very few Instagram followers, so I don’t think she’s being directly targeted or that her whole device is compromised (unless she has good reason to suspect someone would be trying to break into her stuff).

It’s possible her email was included in an unrelated breach somewhere. People sell compromised information from data breaches on the dark web all the time, and if your info was included in a big one it can get rolled up into a megalist and traded around. My email was caught up in a megalist about 7 years ago so a couple of times a year I have someone trying to phish my stuff. Have her sign up for Have I been Pwned. It will tell you which credentials of hers have been compromised, if they’ve been compromised.

Whoever you’re getting the 2FA requests from could just be trying to brute force their way into any account off of the list of stolen credentials that they have. Since people are lazy and tend to use the same username/password across accounts, hackers just try to use the credential combination they have access to everywhere to see what sticks. They can write scripts to do all of that automatically until they crack an account. So again, wouldn’t be too suspicious that someone is targeting her unless she’s got good reason to think that.

Your girlfriend can go to settings >> security >> login information to see if anyone has successfully cracked her account. If someone is logging onto her account from a location/device she’s not familiar with have her remove that login from the list of approved logins and have her reset her password again.

The 2FA messages DO get to be obnoxious though, and the only way I’ve been able to get them to stop is to stop using my phone number for 2FA and start using an app like Authy, Google Authenticator, or Duo. Have her use one of those instead of her phone number.

Good luck! The messages are annoying but as long as you’ve got good password hygiene I wouldn’t lose sleep over it.