Meaning one of his administrators must have set one (likely for temporary troubleshooting), kicking off the whole issue...
edit: if SSH access was indeed the first cause. Running any upload-and-run script as `www` would let them set the password themselves, I think.
Run 'sudo su www -s /bin/bash'. using '-s /bin/bash' will override the usual nologin shell, and running 'su' as root will mean a passwordless account can be su'd too.
This will allow you to try accessing files and directories as if you had the user 'www's privileges without having to make the 'www' account regularly usable.
You should never set a real shell or password for any accounts that a real user will not be using.
Maybe default settings are production settings after all!