We are talking here about seed which is generated in the online wallet, that seed can hardly be more exposed just by typing it in Electrum, provided the computer is virus/malware free and that Electrum is not fake.
I agree that it is probably ok to use the same seed on electrum, but I think it is good to tell him the correct security procedure, which everyone say out there: If your seed is exposed ( typed anywhere) just discard it an use a new one.
I think it is good to tell him that even for educational purposes. I would do it anyway. What if his computer is infected with a keylogger? His seed is somehow safe from hackers now, even using an online wallet, because he has not been hacked so far...
Using of iancoleman tool is the last thing to try, what if a user has a large number of addresses (private keys)? Scanning every private key is time-consuming, and I think that change addresses should be considered in this process.
Yes. It is time-consuming and last resource. He can access the change addresses there using External/Internal set to 1. But I agree, last option...
If the customer support fails to resolve an e-mail authorization problem, then the only way is to recover wallet by seed. Only problem in such wallet recovery would be in the fact that any imported address will not be recovered.
Personally, I wouldn`t even bother contacting their support. I tried once and nobody answered me..