It's not their personal password, it's a special password.
If the client can provide the information over live support they can give them the information or if Blesta makes on then a popup securely allows them to enter it without the staff touching their account.
Tickets, if the client submits a ticket, staff can see the product / client name / email. But can't access their account without being a Manager / senior staff.