I don't think this would be even be theoretically possible because several portions of the code are currently reliant on an HttpContext. There are ways to "fake" an HttpContext in a scheduler method but even those still use the AppDomain of the web folder. Trying to fake an HttpContext from a Windows client would probably not work.
What is the reasoning why the client doesn't want to use a WebService? Security? (that can be worked around--examples from IWeb are pretty good examples how to make a WebService secure). Performance? (having an intermediary webservice really isn't *that* bad a performance hit). Other?
If they really don't want to use a web service, how about WCF? There are some examples here and there (right back to Michael Washington) about how to implement WCF with DNN.
Otherwise you could write your own classes to interact with the DNN database but you'd have to revisit it with every update to ensure any changes in the database structure are taken into account by your own code. At least you would be able to do it without a web service but oh, what a pain in the bum.