Have you tried taking the battery out, shorting the 3v supply with a
paper clip, and waiting a day or so?  I've heard rumors that you can
clear a PROM password in the later 4c/4m systems by pulling the SGS
48Txx chip, and leaving sit on a non-conductive surface for a day or
so.  I've never tried it to confirm the rumor. Use at your own risk...

Has anyone else ever heard this rumor?

Rob