Well, I probed the EEPROM, dumped the contents, disabled the write protect, and updated the configuration byte at 0xFA from its initial value of 0x00 to 0x02.
For reference, I added external pullup resistors to the I2C bus while holding the multimeter chip in reset by grounding the reset test point. When writing, I also added a pulldown resistor to ground the active-high write-protect pin.
Here's my original config dump:
FF FF FF FF FF FF FF FF FF 52 00 FA 00 00 BE 03
10 17 20 4E 52 03 6E 50 64 4B 3C 3C 0A FF 40 FF
F3 98 55 83 64 00 96 00 00 80 00 80 BB 7E 0F 8C
4E 02 09 18 01 09 50 01 0B B5 17 0A 58 FF 09 00
00 01 00 01 00 07 98 00 64 00 64 00 64 00 00 00
00 80 BE 7E 21 8C 00 80 00 80 00 80 00 80 00 80
86 7F 04 80 0A 00 91 2A 00 00 00 00 00 00 00 00
80 81 00 80 35 82 E0 7C 18 01 00 00 00 00 00 00
00 00 00 00 00 16 00 10 00 0C 00 07 17 01 12 03
00 00 00 00 00 00 00 11 00 0D 00 0A 00 02 00 04
00 00 00 00 00 00 00 00 00 00 00 0B 00 13 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00
0D 00 02 10 00 00 00 00 00 00 00 00 20 00 03 10
2C 80 00 80 00 80 00 80 00 80 03 05 0D 00 02 20
00 80 00 80 00 80 00 80 00 80 00 80 00 80 00 80
00 80 FF FF FF FF FF FF 5A 0F 00 00 00 00 00 00
Unfortunately even after updating the config at address 0xFA, it doesn't seem to output anything on PT1.4 (as probed on the not-vcc-side of R29). I'm not entirely surprised, since I never observed the multimeter reading from address 0xFA.
Here's a dump of the read operations I saw (this includes turning it on, pushing a bunch of front-panel buttons, then hard power cycling it):
(addr=F8, 2 bytes): 5A 0F
(addr=12, 2 bytes): 20 4E
(addr=33, 12 bytes): 18 01 09 50 01 0B B5 17 0A 58 FF 09
(addr=20, 4 bytes): F3 98 55 83
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=50, 6 bytes): 00 80 BE 7E 21 8C
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=EA, 2 bytes): 00 80
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=EA, 2 bytes): 00 80
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=60, 8 bytes): 86 7F 04 80 0A 00 91 2A
(addr=70, 12 bytes): 80 81 00 80 35 82 E0 7C 18 01 00 00
(addr=D0, 2 bytes): 2C 80
(addr=D2, 2 bytes): 00 80
(addr=60, 2 bytes): 86 7F
(addr=D4, 2 bytes): 00 80
(addr=D6, 2 bytes): 00 80
(addr=60, 8 bytes): 86 7F 04 80 0A 00 91 2A
(addr=70, 12 bytes): 80 81 00 80 35 82 E0 7C 18 01 00 00
(addr=60, 8 bytes): 86 7F 04 80 0A 00 91 2A
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=12, 2 bytes): 20 4E
(addr=33, 12 bytes): 18 01 09 50 01 0B B5 17 0A 58 FF 09
(addr=20, 4 bytes): F3 98 55 83
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=50, 6 bytes): 00 80 BE 7E 21 8C
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=EA, 2 bytes): 00 80
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=12, 2 bytes): 20 4E
(addr=33, 12 bytes): 18 01 09 50 01 0B B5 17 0A 58 FF 09
(addr=20, 4 bytes): F3 98 55 83
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=50, 6 bytes): 00 80 BE 7E 21 8C
(addr=40, 14 bytes): 00 01 00 01 00 07 98 00 64 00 64 00 64 00
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
(addr=EA, 2 bytes): 00 80
(addr=2A, 6 bytes): 00 80 BB 7E 0F 8C
I noticed that it does read from address 0x33 and 0x72, which are not documented in the datasheet that Kerry Wong translated. Perhaps there's some new functionality, or the meter is simply storing additional configuration in unused space in the EEPROM.
It's also possible that I need to press a different button to actually trigger the check for the REL / RS232 functionality, since a lot of config seems to be read on-the-fly.