That slider affects (when I asked a couple weeks ago) whether 2FA requirements happen on every login, or just first logins from devices. It doesn’t actually turn 2FA off entirely.
Your Ghost logs may be in (ghost directory)/content/logs. It depends a bit on server configuration, but I’d start there.
Setting up outbound email can be pretty easy. You can set up Mailgun in config.production.json. If you’re going to use Mailgun SMTP (which is what the docs show), you’ll need port 2525 on Digital Ocean - they’ve got more common ports blocked. Or you can use the Mailgun API for transactional email also – see here: Missing documentation for mail config options – Mailgun API support. If you’ve already got a Mailgun account, it should be a 10 minute job.