We have a customer who has an ITIN number and a social security number, but she has informed us that all IRS reporting should be under the ITIN number. Does one number have preference over the other?

I went to IRS.gov and put "ITIN" in the search box. A few choices down is an explanation that contains this: "IRS issues ITINs to individuals who are required to have a U.S. taxpayer identification number but who do not have, and are not eligible to obtain a Social Security Number (SSN) from the Social Security Administration (SSA).
ITINs are issued regardless of immigration status because both resident and nonresident aliens may have U.S. tax return and payment responsibilities under the Internal Revenue Code.Individuals must have a filing requirement and file a valid federal income tax return to receive an ITIN, unless they meet an exception."

The ITIN may be valid but chances are the SSN isn't. Neither of them may be valid. We frequently see people who have purchased documentation in a package deal. Not knowing what's what, they present it all.