Just scan your passport and send it to them, what is the problem?
Why should he ? What is the guarantee they won't misuse his password details ? They didn't ask him for verification before signing up or depositing his coins ? That's the problem.
They do this to see if the account is hacked or not when it was inactive probably. Still, asking for a passport scan is stupid if you haven't sent them one before. Keep us updated till its solved please.
There are other ways to check if an account has been hacked,like Zepher said,signing a message from a deposit address.
most exchanges would require for verification. make sure that the email address is truly from btc e holding, always confirm that you getting the message from the original source. if you are then there is nothing to worry about, but if not then don't send it as it may be a scammer. however the decision is yours to make.
Shit Posting Level 1000