It does sound like someone, or something is attempting to access your account, and the 2-factor authentication is doing what it is supposed to.
What's your expectation of Qantas incidentally? Lock the account? Close the account and give you a new FF#?
As per the earlier poster, it could be...