What does SADP show for the firmware version of the camera with the unknown password?
Some versions have security vulnerabilities that could be used for resetting.
A (very) long shot - as I can't find the data sheet for the camera as it's purely for the Chinese market -
Is there a small hatch...