You can report a user directly on SFS's page
here. The data that UBB.threads sends with a report is the Username, EMail, and IP. Basically what's marked as "required" on their site.
Once you ban an IP it should be instant, once you submit data to SFS it should also be instant, but there aren't yet checks built in to log a user out should SFS detect them while they're logged in (which will be looked at in a future version).
The user password is stored in an MD5 string, and the only place to change it is in the user panel as a logged in user. So, unless you have an MD5 hash of a specific password, you can't just use a MySQL query to change a password.
You COULD make a "Jailed" group, and set all of the permissions to -1 (disabled) and throw users into there until you can become them and change their login credentials.
