Not an attorney but will attempt to help anyway.
You mean your potential client registered the name with that old
host or the registrar itself, Opensrs? Or someone else registered
it for the client back then?
Unfortunately Opensrs may be right: only a lawsuit can fix it as
there are little to no laws defining the scopes and limitations of
this otherwise irritating problem.
Your client basically has 2 challenges:
1. To prove he indeed owned the domain name and never ever
authorized any changes.
2. To prove the old host or whoever else made the unauthorized
Your client could use the UDRP, though it depends. What content
does the name currently show?
Too many factors to consider...