Why is this a problem? When they request a password, reset the password to some typical password and pass that on to the authorities. They aren't actually going to ask to view your code/database, are they? They just want to be able to access one user's account.