I would focus on these areas:
- Is the information architecture well designed?
- Are appropriate page titles and URLs used?
- Is the navigation and user flow well designed?
- Are there any usability-contributed conversion bottlenecks?
- Perform some user tests to verify your intuition.
- Is the website 508-compliant?
- Is the website WCAG 1 & 2 compliant?
- Is the website exploiting accessibility features of WIA-ARIA/HTML5 semantics?
- Is it following other accessibility best-practices such as skip-navigation/skip-to-content links and non-visual CAPTCHA options?
- Test the site with screen readers and browser zoom to confirm its accessibility to the visually-impaired.
- Cross-browser/platform compatibility
- Identify your target platforms based on demographics data (perhaps through server logs or through market research).
- Test on all target platforms (not just a single browsers version on a single OS; tools like BrowserShots and Adobe Browser Lab can help).
- Are graphics and multimedia well-compressed (e.g. using the appropriate compression format)?
- What's the actual page performance in the browser for critical pages?
- Are you taking max advantage of caching (bytecode caching, query caching, page caching, etc.)?
- Are other performance enhancements needed (e.g. aggregating and minifying CSS and JS, using a lightweight webserver to serve static content, using a CDN, load balancing, precompiling, etc.)?
- Is the site protected against XSS, CSRF, session hijacking, SQL injections, information leakage, and other threats?
- Run some blackbox testing, fuzzing as well as whitebox testing w/ static source code analyzers.
- Evaluate security policies: password policy, use of encryption (HTTPS, SFTP/SCP), and data storage (PII and other sensitive data).
- Is the login form protected against cracking (retry delays, temporary IP bans triggered by repeated failed logins, use of CAPTCHAs to slow down crackers, not disclosing if a username exists, etc.), and is the login process protected against sniffing (forced HTTPS and not using basic HTTP authentication)?
- File/folder permissions, upload forms, email forms, spam protection, etc.
- Other best practices (maintainability, semantics/SEO, online marketing)
- What does the (pre-minified) frontend and backend code look like? Is is modular, readable, and well commented/documented? Are they using MVC or similar architecture? Is it RESTful?
- Is there separation of content and presentation?
- Is the CSS well-designed, taking advantage of cascading styles and semantic classnames and IDs?
- Is the markup semantic and taking advantage of existing microformats? Are proper
rev attributes, sitemaps, product feeds, and other meta data defined to help browsers, crawlers, and other apps understand/use the content?
- Are CTAs prominently displayed, and is the site designed around a web strategy? Or is this just a generic brochure site built without determining specific business objectives? Are they using analytics data and other metrics to measure site performance? Is the site regularly updated with new content and actively used for marketing?
- Are they testing (to optimize web copy/design and marketing spending)?
There are infinitely many other potential areas of optimization (much of it is correcting bad practices, like duplicate URLs, poor web design, lack of documentation, table-based layouts, use of frames/iframes, non-bookmarkable pages, breaking browser navigation/history, etc.), so it's unlikely that a single Q&A thread will be able to cover it all.