Email token session expired, but still logged into the account

So Today I tried logging in into poe2 trade, and as always I was requested to enter my steam account and receive a code from email related to my steam account. The problem I found is that I copied the code from email too late, and the site told me that the token for the session has expired. Normally it should make me take the steps again and send a new verification code. What happend is that I was logged into the site without any verification needed. This seems like a security problem. Look into it. Thanks in advance.