Write it up and provide the analysis along with a brief statement on risk and recommendations to the proper personnel at the client. Beyond that, it is up to them to take action. Likely they have no policy on the subject and will need to institute process changes. Do not be surprised if they do nothing. I give it about a 5% change that they choose to change and mitigate risk.