Almost all security audits in an enterprise/corporate setting are done in good faith. This is a person they hired and I'm assuming have spoken on the phone with so it's not unsolicited.

Trust me, I've had similar things happen. I don't know how there can be security auditors who don't even understand how password encryption works but I've had to explain it a few times. It's awful.