you are perty much screwed -- you'll need to change the main host account password and any email that might be HIS that is attached to administering it, then change the mysql password..
right now, he can just go into phpMyAdmin and do anything he likes..
and this is not to preclude him having some sort of software already installed that allows him in at anytime too..
this is where you'd need to look at the apache logs and not only the ubbthreads logs..
in short -- it's UGLY!
