removal is somewhere under the security tab. however, removing a physical token will make it permanently unusable again. There's an FAQ somewhere explaining the exact removal procedure but I can't find it now.

Still doesn't help if you can't even log in though :/ I hope there's an easy way to remove it if you have the numbers from it, but I haven't checked.