I have to agree partly with the original poster's
SEO. You do need to see the code, like others have said, but you don't need to see it in-situ, that is, on the very website. I would ask the prospect to zip up a few relevant files, e.g. header, footer, index, sidebar, anything that makes up product pages and other distinctive page layouts.
Now most website owners wouldn't know where to begin, so they could be asked to zip up the whole collection of php/asp files. But most people wouldn't know where to find them, or how to zip them up, so the thought of giving the original site's login is looking like the best option.
The quoting
SEO also needs to protect themselves, so I would recommend that a simple contract be drawn up just for the quote. It should state that the
SEO will not damage or change anything on the site and that the owner will immediately change the password after the
SEO has taken a copy. The
SEO will treat this knowledge as commercial-in-confidence and destroy the code if the
SEO contract does not eventuate.