Meanwhile, I got locked out of the old FB account, with a passport scan being the only way they're going to open it again.

Strong password, 2FA, email, registered pgp key, and I still have access to everything, yet they still need to "verify", which makes no sense given they (supposedly) don't have any ID of mine from before.

Contrasting that to OP and yeah, an insider sounds like the more likely thing.