Well to be honest he said hacker, so first thought of mine was SQL injections,
went to his site, popped a basic injection and voila, all accounts banned
Among other things i noticed when arriving, i have offered to secure the server for them for a small fee.
We will see what happens next