Originally Posted by venus

take his IP address, download your server log and do a search for it in your logs and see what username is associated with the IP address then remove that username from your password file.
that would be the very first thing I would do - then keep an eye out for the fool signing back up again.