Phew, figured it out - and you DO need to use an existing one-time code to get another set (so my concerns were warranted). It also looks like, if you have no more single-use codes left, you have to delete your Login.gov account and create a new Login.gov account. How that affects information held in your SSA account (e.g., do you lose historical information?), I don't know.
After a fair bit of going around in circles, I went to the login.gov site (NOT via my ssa account login), and logged in using my email address and password. This does NOT actually get you into your login.gov account, but is the first step in the two-part authentication process. At the bottom of the page there was an option to "get a new set of one-time codes". This is where I was required to use an existing single-use code, after clicking on the link to get new codes.
All really confusing and I can't imagine how much some people may be totally confused by the process!
So, lesson learned: If you use the two-part authentication process for login.gov, don't use up all of your single-use codes before requesting a new set!