You need to check all related service plans (include service plans that were created under reseller accounts) that the permission 'Hosting settings management' is granted.
Turns out client already had that permission and wasn't doing it (they were expecting it to be an option upon initial sub-domain creation - which, it really should be!)