Assuming you'd remembered to click "Submit Changes" at the bottom of the CP screen after you removed the URL, then if it wasn't you who put it back there and it wasn't him, it must have been the tooth fairy. <img src="https://www.ubbcentral.com/boards/images/graemlins/wink.gif" alt="" />

Locking the profile has prevented a reoccurence of the problem.

Supports the theory he's taking the p**s. IMHO you've done the right thing locking his profile. Just watch out for affiliate links in his posts.