You're welcome Sara. I'm leaning towards no penalty associated currently, but you'll want to use your judgment. Things like percentage of spam to reputable links, whether or not the client is showing up for branded searches, number of pages listed via the 'site:' search, and so on. If they don't appear to be penalized and are competing about where to be expected then these links likely aren't affecting them.
GWT doesn't guarantee showing all backlinks, so yes, it is a possibility that you won't find them there. You can use other backlink checking tools like Majestic and Ahrefs to compile an even larger list, while a site like https://www.rmoov.com/ can help with speeding up the cleaning process.
Finally, it'd probably be instructive for you to run several sites through OSE and see how much spam is common place so that you can start to get a feel for it. Much is from content scrapers that are linking unintentionally, things of that nature. Google knows to ignore them for the most part.