"Is X legal" questions are hard. At a guess, though: probably. In general.
The best we can generally do on an "is X legal" question is think about all of the ways in which X might not be legal. I'm going to assume US jurisdiction; know that most legal considerations here vary widely from one jurisdiction to another.
Criminal liability
Maybe you're violating some criminal law. Individual states may very well have some kind of weird laws, but on the federal level the main one to worry about is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. It proscribes a variety of acts, but the broadest is:
intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing]... information from any protected computer
The term "protected computer" has expanded to include virtually any computer connected to the internet. The question, then, is whether the access described in the question is "unauthorized," or constitutes "exceed[ing] authorized access." The law seems to be (see the DoJ's official guidance, https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf) that a ToS agreement constitutes a limit on access and, therefore, that access in violation of a ToS agreement is prohibited by the CFAA. This will in turn depend on the specific service with which we're concerned.
Civil liability: breach of contract edition
Maybe you've formed a legally binding contract with the service you're trying to "hack," which contract prohibits your conduct. Certainly, most ToS agreements purport to be contracts, and courts have generally held that clickwrap agreements (of the sort to which you agree when you create an account, for instance), can be legally binding. Such a contract is probably a "contract of adhesion," (see WEX: https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion), meaning that some terms can be voided for unconscionability more easily than in a normal contract. In this light, a term prohibiting brute-forcing an authentication credential would probably be held to be conscionable; a term prohibiting guessing your own might not.
Of course, as a practical matter, it's nearly impossible that a company could prove any damages resulting from the kind of unorthodox password recovery techniques described in your question.
So, for Twitter in particular, what violates the ToS?
Per the ToS itself:
You also agree not to misuse our Services, for example, by interfering with them or accessing them using a method other than the interface and the instructions that we provide. You may not do any of the following while accessing or using the Services: (i) access, tamper with, or use non-public areas of the Services, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers; (ii) probe, scan, or test the vulnerability of any system or network or breach or circumvent any security or authentication measures;
Thus I would say that (probably) CFAA violations could arise with an automated bot attempting to brute-force any authentication credential (verification code or password).
I am not a lawyer. I am most especially not YOUR lawyer. If you want legal advice, hire a lawyer.
Also, as a practical matter, one assumes any decently-designed service has some protection in place against brute-forcing passwords via the web interface.