yikes… somehow I missed a follow up on your post which was 4 days ago…sorry about that. Anyway, there’s been a lot of users of this theme and I just now tested a new install of Preference on my local site (on my computer via XAMPP) and did not experience a problem. I fully understand the client and preference to not pass on the login details… so how about we try this if you are able to do this….setup a test site location either on a subdomain, sub directory, or anywhere I can get access to it. You will obviously need to install a clean WordPress for this, and then we can test a fresh install of Preference and see if it happens again for you there (all without touching or logging into your client’s site.
If you are able to do this, contact me via email support from the Support page here on the site.