Users should be able to reset their 2FA and scan a new QR code. The user profile page only has an option to change your password. Currently, an admin must force a reset.