MFA succeeded does not automatically close the alert. An Adversary-in-the-Middle (AitM) proxy relays real MFA and keeps the session cookie. Issuance and use then come from different places.