Someone Knows Your Password

If someone passes a correct password, but fails second factor repeatedly, all from a new, unfamiliar device from eg another country, I'd send this notification too.