Welcome to the Q&A Forum

Christy: I think that the answers have been helpful, but the jury is still out.  I'm taking advice from both Patrick and Toby's input, and I'll update this space as soon as I see some changes. The one question that I don't see answered is: are these 404s definitely harming the website's SEO, assuming that they are NOT being visited by users?  I'd love to know what people think on that.

Patrick: thanks so much for your help on this. I just wanted to circle back to tell you that the problem is now resolved.  The site is "https://www.", and GWT was first setup as "http://" and then just "http://www." and both of those do a 301-redirect to "https://www."  So in any case, adding a third Google Webmaster Tools account for the secure version of the URL seems to have cleared up the problem and unlocked the keyword query data.

As has been suggested you can request the removal of pages in GWMT and you should keep any wordpress site and plugins up to date. To add to this, you might want to look at something like Cloudflare as an extra layer to protect your clients site. We've been using it for a year now and its made a massive difference, both to performance and security.