The moment he accepted the username/password he engaged in a transaction - upwork rules or not.
He "should" have had the price and work agreed before accepting anything, and if they sent it unsolicited his immediate reply should have been "you need agree before I touch this".
Not The client eventually gave me login details, alas, still no job.
Then
After 3 weeks of sporadic talks, the client trying to get me to work without actually giving me the job.
->The client was incredibly unprofessional (but not unprofessional enough to be named and shamed I see), but if you are taking login details without a job assignment you are asking for trouble.
1) it may have been unsolicited (you mentioned this), and 2) humans tend to be very "fuzzy". Maybe he should have towed the line, and now he's learned his lesson about why you always cover yourself.
But 99/100 times the human being on the other side just wants to get you the information you need and is just too trusting. We've all had those clients, and it's up to us to be trustworthy and not be the one who teaches that client what can happen if you don't protect yourself [1]
[1] Obviously what I mean by this is that you shouldn't be fucking over your client, educating them is another matter.
in this case, a hundred or so $ to work up a spec, deliver that to the client along with an estimate of the time that should be involved. They can either give it to you, someone else, or abandon it.
Except he never chose this client. He exchanged a few emails with a potential client, saw a red flag, and then decided not to work with him.
He did exactly what you suggest, and now cannot accept any work through Upwork, has lost all existing work, and will not be paid for already completed work. All from declining one client.