Maybe accounts for clients like the AP need not a two-factor system, but perhaps messages should only originate from a whitelisted set of IP addresses.
Are you suggesting that there may be many AP reporters who are authorized to tweet on AP's behalf from the field, implying a total lack of editorial control (and probably a total lack of coordination as well)? I think that is very unlikely. I'd find it very hard to believe that there isn't a very well defined system in place to control all official correspondence.
They have a news desk that is staffed 24hrs per day. Surely a person there could monitor tweets or communications from reporters in the field. I'd even expect there to be a different individual with the keys to the Twittermachine.