Android Password Recovery + 2 Step Auth. What happens?
You can use your normal Google Account password to unlock the phone (as long as you are connected to the internet), even if you have 2-step authentication turned on.

I have tested it on a Galaxy Nexus running ICS and another running Jelly Bean, and on a Nexus 7 running Jelly Bean. There might be a possibility that this was different on Android 2.3 but I don't think so.