You mentioned they were a new client. What type of company are you? With that info we could help more.

“However, they have also produced hundreds of copy-written material on their blog that are replicated all over the web ( other dental sites mostly.. ). Some of the content has been taken directly out of published medical journals and pasted word for word on our client's site.”
> You can't do anything about other sites as you don't control them. You could send an email to the webmaster and alert them to what is going on. You can sometimes find the webmaster email by a WHOIS search. This will not be counted against you and may even be helping you. I have seen many duplicate content pages rank above the initial post/author of the content. If it is on your site you will want to remove it or rewrite it as soon as possible even if you are ranking well for the content.

Once you have all your own content on your site do implement the Google rel=author mark up so you are know known as the author of the content on your site and will receive the credit. This is not something Google states publicly but once you are the author of the content you will be seen as the originator of the content.

“We asked for logins to all the accounts they created, which they refuse to provide. We've heard the horror stories about canceling services with firms like these where they nuke everything.”
> Most like those listings will stay and they won't be able to nuke them. There is a number of reasons for this.
1. most of the important listings like G+ will require a postcard or a phone call to happen to the office phone# in order to edit the listing. You mentioned the phone was not changed for their tracking purposes so you should be good to go. If they cancel your Yelp listing...if they have access create a new listing and let Yelp know of the situation and they should be able to restore reviews, etc. *It may take a while, but they will understand and it isn't their first time dealing with this. **I am not sure on this but you may also be able to ask them to 301 redirect the old listing to the new listing. This could also be wishful thinking.
2. If you are referring to other sites like directories/citations (DMOZ, BOTW/ local.com, superpages.com) they will have a tough time taking the listing down. They would have some work to do and some “properties” are totally automated so even if you wanted to take a listing down you couldn't. We would need to know the specifics to guide you there.

"We have also asked to provide proof of ROI, but they decline because we declined using registering a call tracking number that they can use in the directories. "
> They have a valid point there. Without using a forwarding phone numbers it is tough to verify the organic call leads unless the receptionist asks verbally.

They should have Google analytics goal tracking set up for any contact form submissions that come through. This will let you know whether the submission came from organic, paid, newsletter, referral, etc,. but it won't get down to the keyword level. New Google changes hide the keyword referring data.

You could use some advanced analytics tools (KISS Metrics) to get a better idea, but not sure if it is worth the time for your dental practice. You could also ask your future SEO/marketing co. to let you know of the call tracking software they want to use and then sign up for the account under your own name and be in control of it. Then you could track the metrics and be in control.

I wouldn't suggest placing them on scam sites. This can surely backfire and cost you more time and money than starting fresh. TBH most of your properties will stick that they created. It would take a decent amount of work for them to go through and remove them all. Just in case go through and grab all your current properties like citysearch, kudzu, etc. and copy your descriptions and phone and address data so you can quickly implement it back in the case that some are deleted. *They probably didn't do a good job on the listings if they are being this stubborn. I suggest not using a business descriptions for these listing more than 3 or 4 times. Most likely they use 1-3 on every property they built. There is some tools that will show you all the citation listings you have.

Pro tip* On any future directories/citations always make sure you name address, phone is exactly the same on each listing. This would get right down to where a period, comma, suite vs. # is placed. It is best to just make it all consistent.

The big take away here is the use your own email account, phone tracking, Google analytics, server, CMS, etc. you create in the future for any tasks that your SEO/marketing firm will do, Check it regularly to make sure no passwords were changed and include your rules in any agreement you sign.

Feel free to get in touch anytime. All my Clarity time goes to charity.