Note: this is basically "a practical application of SSLstrip". Once you are capable of pulling that off, full control of the ssl-stripped site is a lesser concern. Interesting (and perhaps juicier as a media soundbite than "OMG SSLstrip exists!"), but not groundbreaking.
Yeah, I wasn't trying to focus so much on SSLstrip, but rather that it's possible to get into an account that has Two-Factor enabled, and generate a OTP that will allow for sans Two-Factor logins going down the line.
Weakest link gets attacked - and with one-factor auth still available, that is the weakest link. IMNSHO, labeling this scheme as "two-factor" is misleading - "two-factor with possible backdoor" would be more appropriate. (Also, I think that "OTP" is more commonly used to mean "one-time pad" - now that would have been more secure :))
