What’s in the box Phil?

I took some pictures

It appears to be the common Sunplus 1628A based reference design shared by many similar Chinese origin trail cameras.

Did you reset the PIN?

Err nope. No sign of a battery, so assuming it writes config to flash, and I was unable to find a button-mashing-based reset process (although there likely is one as the manufacturer offers a telephone reset service)

We got lucky, the owner suggested a few numeric pairs they usually use (I know - poor practice, they know too), and after 20-30 combinations we got the magic value :)