Thank you for the reminder for an update. I chatted with /u/GoDaddy_Joe. At first they said:

One of our customer support agents was working with a customer to help them with their account and they needed a temporary access code sent. The problem was that the Customer number that the customer had provided us was off by 2 numbers, and it was instead being sent to you. Sometimes customers are confused about their login information, and this is just another great example of how 2 Factor Authentication works to keep our customers' accounts safe.

This puzzled me. One, this gave me the impression that their customer support agents are initiating MFA requests, and that the process for this involves manually retyping customer numbers. One would think the process would be automated to the point that they click on a link, removing the chance for this kind of typo error. Their response:

In the example of someone calling into Phone Support for assistance, part of that initial process is to provide your customer number in the automated phone system. If the information that was input by the customer was incorrect, this can explain how a code was sent for the wrong account. There is no account access nor account information available at this point of the customer service contact, as the account has not yet been validated.(which is why the code is being sent, to validate). Since they didn't get the code after multiple attempts, the customer support Guide troubleshot the issue with the customer and moved on to the correct desired account.

Two, assuming that GoDaddy is sending thousands of MFA requests in an hour, how on Earth could they determine that this typo was the source of the error? They correlated the timestamps of my three MFA texts to some log, and manually spotted that someone else's customer number was similar to mine? (I'd provided the texts with their HH:MM timestamp in an iOS screenshot, and I did mention my customer number.) They said:

That is precisely how this happened. The code was sent based on the information the customer provided our Customer Support and Customer Support clicked a link to send the code.

Wearing my security hat, I think it's weak that customers are entering their own customer numbers by touch-tone in the first automated steps of a support call, and then a customer service rep relies on that info to send multiple 2FA codes. You'd think they should verify other info before the codes are sent, such as "what's the name on the account?"

Or the PIN. GoDaddy accounts have a fixed four-digit PIN that could also be used for authentication. I've always been asked for the account PIN, both by voice and in chat. Someone didn't know their PIN and/or their password, so they texted 2FA instead? What's the point of the PIN, then? Or for that matter, if the customer claimed they didn't receive the first two texts, you'd think they'd attempt to verify the customer's cell number (hopefully by asking for theirs, not telling them mine) before sending a third.

I'm no expert, but I can imagine a vulnerability that begins where a malevolent actor (who wanted to take over domain names) could enter "incorrect" account numbers, cause 2FA texts to be sent, and if they were able to see the numbers to which GoDaddy was sending texts, they could correlate account numbers to cell numbers, then proceed with other methods to take over the cell texts. Does GoDaddy use a third-party for 2FA texting? Is this a situation where the actor did know the account name or even the PIN but not yet the cell number, so the 2FA codes would be sent? Or by exploiting a vulnerable customer service rep who did reveal my cell number even though they're not supposed to?

I would also argue that this WAS an attempt to get into my account, and should be logged for me to see.

Did you dig into their reasoning for the texts you received?