My client says that one of his old developers found some code that allowed a past developer to access the site in certain ways. She wrote code to allow herself to log in to certain restricted areas and to send herself emails when certain things happened on the site, for example user sign up.
My client now wants to make sure that this is not going on. He has asked me to do this by looking over all the source code. Now that might be useful, but what is the best way to rule out that a past developer is using something like a backdoor to still access the site?