The aws command didn't get rid of the old software token mfa for me, so I solved this problem in a different way. I deleted and re-imported the userpool record. This might not be an option for everybody, as you end up with a different user ID in the pool.