I also really feel this guy is trying to get the password by social engineering means or something it just seems completely ridiculous to ask for this stuff. Why would he need the info in the first place? I wished the author of the post had asked him that. I'd like to know his answer to that.
I can tell you what it is, he's got some requirement he needs to fulfill (like, say, ensuring password strength) and he's figured out some way to satisfy it by analyzing all of the plain-text passwords. He refuses to give his reasons and refuses to back down because those are parts of the personality flaws which have led him down this road to start with. People who never accept they are wrong, never accept criticism, and never give up on bad ideas: those are the people who hold on to bad ideas forever. How do you think incompetence is maintained in the face of a world filled with people hostile to it? It takes a strong defense mechanism.
Social engineering was my initial suspicion as well. However, that really doesn't fit with the auditor's obstinate response. At this point an intelligent auditor should be coming clean so that this doesn't go public (and so that his company doesn't lose the contract and get further heat).
I have the same concern you do that he shouldn't need this information. Reading some of the other comments here, though, leads me to believe that there really are people who feel like this is "security". I've definitely encountered sites and password systems that require you choose drastically different passwords from any you've chosen in the past. This may be what the auditor was getting at (though in my opinion it's a weak, even counter-productive security measure)
