There are C(4,2)=6 ways to request two digits.
Let's say the 4-digit number is ABCD, and let's say the attacker saw AB.
The possible requests the attacker would see are:
AB - 1/6 * 1 (he doesn't have to guess)
AC - 1/6 * 1/10 (he's got a 1/10 chance of getting the digit he didn't see)
AD - 1/6 * 1/10 (ditto)
BC - 1/6 * 1/10 (ditto)
BD - 1/6 * 1/10 (ditto)
CD - 1/6 * 1/100 ( he's got a 1/100 chance of getting both digits he didn't see)
Add them to get 47/200.
Once he's made the first observation, there's only one observation (of the six that are possible) that will give him complete information. Therefore, the probability is 1/6 that he'll know all four digits.