I also operate a password recovery service. Indeed you don't need to risk any money - to discover and validate a password only requires empty Bitcoin addresses from the wallet.

If this is not a scam the person should be able to go back to the exchange where they bought their coins and get a screenshot of the transaction history. Of course you can fake that but it'd help provide some substance to the claim.