Actually, while I generally agree with everything i'm reading - this one part I don't quite agree with. (He exchanged a few emails with a potential client, saw a red flag, and then decided not to work with him)
The moment he accepted the username/password he engaged in a transaction - upwork rules or not.
He "should" have had the price and work agreed before accepting anything, and if they sent it unsolicited his immediate reply should have been "you need agree before I touch this".
Not
The client eventually gave me login details, alas, still no job.
Then
After 3 weeks of sporadic talks, the client trying to get me to work without actually giving me the job.
->The client was incredibly unprofessional (but not unprofessional enough to be named and shamed I see), but if you are taking login details without a job assignment you are asking for trouble.
While I agree with you in spirit, there are two points to consider
1) it may have been unsolicited (you mentioned this), and
2) humans tend to be very "fuzzy". Maybe he should have towed the line, and now he's learned his lesson about why you always cover yourself.
But 99/100 times the human being on the other side just wants to get you the information you need and is just too trusting. We've all had those clients, and it's up to us to be trustworthy and not be the one who teaches that client what can happen if you don't protect yourself [1]
[1] Obviously what I mean by this is that you shouldn't be fucking over your client, educating them is another matter.
Its probably worth pointing out, that in either 1 or 2, the correct/professional way to do it (if the client wants a fixed price but providing one requires additional work) is do a go/no go first.
in this case, a hundred or so $ to work up a spec, deliver that to the client along with an estimate of the time that should be involved. They can either give it to you, someone else, or abandon it.
The moment he accepted the username/password he engaged in a transaction - upwork rules or not.
He "should" have had the price and work agreed before accepting anything, and if they sent it unsolicited his immediate reply should have been "you need agree before I touch this".
Not The client eventually gave me login details, alas, still no job.
Then
After 3 weeks of sporadic talks, the client trying to get me to work without actually giving me the job.
->The client was incredibly unprofessional (but not unprofessional enough to be named and shamed I see), but if you are taking login details without a job assignment you are asking for trouble.