No, it's not like the password to an email service.

It's basically using the private key that controls the unspent outputs of a Bitcoin address to produce a signature for a message which can then be verified using the public key. As I understand it, it's basically how PGP works. All wallets capable of being a full node (Core, XT, Classic, Unlimited, etc.) have this functionality. I'm fairly sure Electrum, Multibit and Armory do as well. It's also available, though less common in mobile and web wallets.

The only issue with signing a message is that it reveals a public key (assuming it wasn't made public previously), which increases the vulnerability of associated funds to quantum (and possibly other attacks), so it might be simpler just to move some of his early coins. If I were to sign a message, I'd subsequently move the coins anyway just to keep them as secure as possible.

e: added a bit