If you have an online account and forget the password, are you allowed to guess it? What if you automate the process, like in a brute force attack? Can other things, like the verification code be guessed too?
If relevant I'm wondering about Twitter in particular.
If the website and its login are designed competently, then experienced hackers can't in practice access your account without knowing your login, and therefore you can't. If they gain access, then by attacking the whole site in a way that would be illegal for you, when you're genuinely trying to access your own account.
You may be violating their terms of service by using a bot. And they may take counter measures, like banning your IP address, assuming it's a hacker trying to break into your account. "Guessing" should be fine, but don't try to be too smart: A bot isn't "guessing".
The best we can generally do on an "is X legal" question is think about all of the ways in which X might not be legal. I'm going to assume US jurisdiction; know that most legal considerations here vary widely from one jurisdiction to another.
Maybe you're violating some criminal law. Individual states may very well have some kind of weird laws, but on the federal level the main one to worry about is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. It proscribes a variety of acts, but the broadest is:
intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing]... information from any protected computer
The term "protected computer" has expanded to include virtually any computer connected to the internet. The question, then, is whether the access described in the question is "unauthorized," or constitutes "exceed[ing] authorized access." The law seems to be (see the DoJ's official guidance, https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf) that a ToS agreement constitutes a limit on access and, therefore, that access in violation of a ToS agreement is prohibited by the CFAA. This will in turn depend on the specific service with which we're concerned.
Maybe you've formed a legally binding contract with the service you're trying to "hack," which contract prohibits your conduct. Certainly, most ToS agreements purport to be contracts, and courts have generally held that clickwrap agreements (of the sort to which you agree when you create an account, for instance), can be legally binding. Such a contract is probably a "contract of adhesion," (see WEX: https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion), meaning that some terms can be voided for unconscionability more easily than in a normal contract. In this light, a term prohibiting brute-forcing an authentication credential would probably be held to be conscionable; a term prohibiting guessing your own might not.
Of course, as a practical matter, it's nearly impossible that a company could prove any damages resulting from the kind of unorthodox password recovery techniques described in your question.
Per the ToS itself:
You also agree not to misuse our Services, for example, by interfering with them or accessing them using a method other than the interface and the instructions that we provide. You may not do any of the following while accessing or using the Services: (i) access, tamper with, or use non-public areas of the Services, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers; (ii) probe, scan, or test the vulnerability of any system or network or breach or circumvent any security or authentication measures;
Thus I would say that (probably) CFAA violations could arise with an automated bot attempting to brute-force any authentication credential (verification code or password).
