Discussion on question by lakano: is my scheme is less secure than the 99% of websites exposed to theses attacks?

Probably the best answer to this is "No, you should never roll your own security schemes"

What, exactly, is the point of asking for expert advice a design, when you simply intend to either ignore or argue with all of the helpful critical feedback you receive from those experts? Any good design published from even the most technically capable amongst us has been through dozens of rounds of critical feedback and adaptation. You might want to consider adopting that approach.

I'm not going to go into detail, but it doesn't sound like your risk assessment is accurate since it's very different from a typical risk assessment and you're trying to stop small risks with big problems. If you think privacy concerns from integrating with Facebook, trust chain with Duo, and odds of pulling a previous password and guessing an email address are serious risks for your company you need to hire a large and experienced security team.