I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous token is invalidated. The new token is sent with information about the use of the last token, so if someone does gain access to a token somehow the user will know.
The implementation I have has received great feedback as far as UX goes, but I'm facing a lot of pressure from non-techs to "prove" that this is secure. Additionally, our marketing team is concerned that this will be hard to teach customers about.
Aside from the lifetime of the one-time login tokens (they can last a couple of weeks), what makes this any different than forgotten password functionality? Additionally - and this is where this question isn't as easily answered as others that are relatively similar here - are there any respected companies who have implemented a login scheme like this, and are there any papers you can recommend I point to to prove the security of this system?