I'd be point-blank refusing to give them my password. If they need it to migrate data (but why?), then they can change it and tell me what they've changed it to.

Whoever came up with this idea needs to be disciplined or fired if he can't see what's wrong with that. If the head of the firm approved it, he needs to explain that to his auditors and hope they don't recommend he lose his business license.

Wade.