While I've personally have not had any issues with Namecheap.
I know I've mistyped my password a number of times for lots of sites, whether it be a typo or having my capslock on by mistake.
Every case is different but I think it's doubtful that it was only a wrong password, had to be combination of criteria in addition to the password to raise the red flag.
Not only that, it is you who is requesting support, but the domains are your client's. So that in itself would cause some concern for me if I was a registrar - for someone to be asking about someone else's domains.
Also, having a toll fee support can be expensive - and that cost would eventually have to be passed on to the consumer.
Hopefully your client can get this resolved.