yoursite.com/admin/membermanage.php
allows you to ban his IP, although if he's web savvy he'll just use a proxy to get around that.
i'd change the mysql password too and also configure mysql (if possible) to only allow localhost connections.
if he knew the FTP password, then nothing you do will stop him from screwing with you.. you'd need to change that too..
you mighta banned him too quick, before getting all the stuff secured
i guess i'd have to look at it closer to see what's going on though..
