I have experience attempting to do exactly what you are talking about here with very little result. My company used to buy links from "SubmitEdge" and their link building practices are shady at best. Thousands of terribly written articles, directory submissions, message board comments, and other ridiculous penguin-tastic links built through them.
I spent a good month or two working at getting them to help me in the removal of these links. They pretty much did nothing but inform me that their practices are well-established and in-line with Google's policies.. (untrue. incredibly untrue.) So what I started doing was asking for logins and passwords of the accounts created to go onto ridiculous message boards and post terrible links. The beautiful thing is they were able to give me lists of everywhere they built a link. And for the articles, they supplied me with usernames and passwords. This meant several weeks worth of work for me to go through each one and remove the articles and links.
However I was left with all the social links and directory links. Some of the article links also did not allow me to login and upon further review the blog sites owned by Submit Edge were the ones I couldn't log in to. I went back and forth with them and they eventually stopped responding to me and would not help me log in to those. They still exist to this day... I've yet to disavow because I haven't seen results of any penalties but I have this all documented of course.
Anyway I digress... The point is, you can battle all you want and it might get you a little further but ultimately they are going to do very little and claim they have done nothing wrong the entire time. (This is my experience with only one company of course.) It is frustrating to say the least. Especially when I know they could just ask their staff member what "djnaro23" password is so I could go through forumland and remove all the stupid links. But no..
One more note -- I ended up trying to guess a lot of these passwords for the aforementioned social links I was unsuccessful with. I will say that they are incredibly lazy people and several of the logins ended up being simple passwords. I literally copied the username and used it as the password and this worked about 33% of the time.
In summation, good friggin luck getting them to do any work for you; they will most likely refer you to their paid link-removal service which is a huge scam. However you should be able to garner a bit of information and hopefully some logins which will give you the ability to go back and remove them yourself. Or at least, as in my experience, remove SOME of them...
Fun, huh?