GroundZero

Do you feel like this stress is coming from responsibilities you're uncertain of being able to meet or do you doubt your qualification? If so, you might be experiencing "Imposter Syndrome"

I would rather focus on metrics in the report: Amount of people who fell for the phishing mail; Duration of time between receiving email and opening; Duration of time between receiving email and clicking a link or performing an action; Action performed (entered credentials, downloaded file, replied to email); Amount of reports at the IT Helpdesk. If the report shows that 35% of all users entered their credentials within 5 minutes of receiving the email, the company has work to do on awareness. If 70% clicked the link but never entered creds and 35% reported the email to Helpdesk, much better.

As a company, you should never want to pick on the people who "failed" a phishing test. By picking on them for their "bad results", you're scaring them away from reporting something potentially phishy or dangerous to IT Security. You do want to use the results to get a baseline of the IT Security awareness within the company. Also, so 70% of the company fell for the email. What does this tell you? Is this a company with a low awareness, or was the phishing email just too well crafted? In a phishing exercise your goal is not to bait as many people as possible, but to educate them on the risks

Your MAC address can be used for 2 things: (1) facilitate in analyzing log files by matching MAC addresses with a device, and (2) use MAC-address based access controls on the network. That last one provides a weak layer of security, as MAC addresses can be spoofed to impersonate a legitimate network user. The first one could make sense if they, for example, would have to comply to certain regulations demanding the identification of network traffic (e.g. identify which device was visiting a black market website or launched a DoS attack from the school's network).

Since you probably hash your password using a salt (you should), you may or may not be able to do the same hashing function on the username to see if the username hash matches the password hash. Anyhow, for sensitive operations (changing pw, changing email address, changing username, etc.) you should always ask for password confirmation.

@Mehrdad It's not like your the company doesn't have your home address. You're only giving your IP to the tech guy in charge of allowing your IP to use the VPN (which would only give him/her an approximate location), while you're giving your home address to the HR dept. Which of the two seems to be more private? PS: My 'location' is often waaaaay of because the geolocation service gets my ISP's location instead of my home location. But your mileage may vary with this.