Actually, while I generally agree with everything i'm reading - this one part I don't quite agree with. (He exchanged a few emails with a potential client, saw a red flag, and then decided not to work with him)

The moment he accepted the username/password he engaged in a transaction - upwork rules or not.

He "should" have had the price and work agreed before accepting anything, and if they sent it unsolicited his immediate reply should have been "you need agree before I touch this".

Not The client eventually gave me login details, alas, still no job.

Then

After 3 weeks of sporadic talks, the client trying to get me to work without actually giving me the job.

->The client was incredibly unprofessional (but not unprofessional enough to be named and shamed I see), but if you are taking login details without a job assignment you are asking for trouble.