The first thing to do is to determine if domain name really IS registered to your client. It sounds to me like it may not be.
Check the WHOIS information and see who the registrant is. Is it your client? Or somebody else?
Many web hosts offer "free" domain name registrations, but really what they are offering is to register the domain name of your choice, with THEMSELVES as the registrant. You then have the right to use the domain name as long as you host with them. But it is THEIR domain and if you leave the host you don't get to take the domain name with you.
If this is the case, your client likely has no legal leg to stand on. Perhaps their was some fraud up front, but more likely, it's all there in the fine print that your client agreed to.
It's important to read the fine print UP FRONT, not after you have a crisis.
Your best best is to negotiate and get your client to buy himself out of the mess he put himself into.
If, on the other hand, you client is the registrant, but somebody else is the administrative contact, and your client doesn't have the necessary login and password information to change this, go to the registrar's web site and determine the procedure for having your client change the administrative contact and obtain new login and password information. They will have a procedure for your client to prove that they are the registrant.