If he can bridge the switch with the EOP connection, he can also directly download the information on a flash drive. I would be more worried about that. There are even SD cards with built-in wireless capability.
Or he could just add any type of wireless router. This could even be on a non-standard frequency (like the ProxyHam that was in the news recently). The frequency could be from longwave (which would go through a Faraday cage without problems and would require really sophisticated magnetic shielding), shortwaves up to lightwaves (infrared).
Wireless modules are very cheap and easy to set up.
Also note that ethernet over power has a very limited range due to design tradeoffs (the high data rate). If someone with electronics skills makes different tradeoffs, the range can be much larger.
A typical PLC module has 10W of output power. With this kind of power it is possible and very easy to set up a wireless link around the world (at the expense of the data rate).
Here is one guy who set up a connection over 20000km using only 5W of power (http://www.ft817.eu/qrp-long-path-qso-to-australia-5-watts-with-yaesu-ft-817/)
An AC/DC/AC UPS has no guarantee that it will filter out high frequency components.
Even if the UPS filters the frequencies, crosstalk between the input and output cables can couple the secure and public sides.
Propagation of electromagnetic waves is very very difficult to predict in practice. You could get a spectrum analyzer and prove that nothing propagates past your UPS (actually it is not that easy, because the signal could be below the noise floor), but when someone puts in electrical cables not connected to anything, they might bridge the systems through capacitive coupling.
If your customer really needs to be protected against a rogue transmitter (which could be PLC or anything described above), he needs to have a fully shielded room with a filter built-in directly into the shield.
If this is not required, not having any open network ports and padlocks and tamper evident seals on the equipment could be a cheap fix.
I don't have the reputation to comment on the answers recommending a spectrum analyzer:
I agree with those, but would like to add that it is not easy to find a clandestine signal on a spectrum analyzer for three reasons:
You are looking at an enormous frequency band. This band will have many thousands of frequencies from radio stations, switching power supplies, monitors and soon. Each emission will show up as multiple peaks on the spectrum analyzer due to intermodulation effects. Looking at the display, you will see tens of thousands of peaks, and each single one could carry out the information. You will have to positively identify every single one of them. This is not made easier by the fact that legitimate radio stations come and go all of the time, switchmode supplies change the frequency due to different loads etc.
Even if you see a peak, you have no idea if it contains secret information. A LCD screen for example will create something that looks like harmless noise, but actually contains everything shown on the screen.
A clandestine emission can be hidden in the noise floor. If the attacker only wants to take out a small amount of data (1kb/s or so), the signal can be impossible to find.
The attacker can always use a timer to transmit only at night, when you are not looking at your spectrum analyzer.
tl;dr: it is impossible to check a signal for clandestine information content.
The only way is to:
Build your Faraday cage with all the filters in the wall in place, but don't run the equipment.
Use a sensitive spectrum analyzer to see if you can receive any radio emission inside of your cage. (Not an easy measurement)
Apply a very strong signal to your power lines and see if it propagates through the filters.
Always keep in mind that there is a tradeoff in SNR/bandwidth and information rate. A sophisticated attacker can always penetrate any shield, all you can do is reduce the bandwidth of his channel with better filtering rate.
With signal processing it is possible to detect a beating heart in a collapsed building (developed to search for earthquake victims). How do you prevent the attacker to move out signals by mechanical vibrations? Changes in the air pressure? Changes in the power consumption of the equipment? A smart electricity meter can detect which TV program you are watching. To avoid this, you'd need to have a generator inside of your secure area (and always run it at constant power).
Better solution is to disable network ports and also lock power outlets. Have one for the cleaners and one for service technicians and put a padlock on when they are done. You can find all kind of equipment searching for the keywords logout/tagout.
[I don't work in computer security, but I deal with electromagnetic interference and radio communications. I know how difficult it is to shield unwanted signals.
My recommendation is to do an analysis of the threats (protection against malicious data theft by a trained adversary with suitable resources, protection against stupidity) and then see what you can live with.
It makes no sense to use a shielded room if someone unsupervised can walk in and copy the data onto a flash drive.
If protection against malicious RF transmission is really an issue, you'll have to get an expert in the field and probably do heavy construction to do shielding, create a secure area around your Faraday cage and so on.]