If it makes you feel better I had a similar, but not so exciting, situation happen to me in the past. So it's not entirely outside the realm of shit that happens. What does seem super fake is the doubling down, having it an SOP/SSP, and the tripling down without some crazy amount of escalating.

For example my experience went sort of like this:

Low Rent Auditor: Please supply a list of username and passwords for xyz systems.

Me(ccing boss and internal secops): No. Why are you asking me for that? <Links to internal SOPs, guidelines, basic common sense, etc>.

Low Rent Auditor: We need this for x box on y form. <attached>

Me (ccing their Sr. Auditor): That's not what that is asking for. Here's a copy of the PAM config. <attached>

FIN