Turns out this was a Facebook bug after all.

We switched the Firewall back to the way it was, without changing the code, and hey presto - all is well.

Not only that but the second step (email invites) was not displayed.

FB - All your base are belong to us.