lol
This is what I am going to do. First, I'd have my main account, then I'd have a Media Center Account that is bascially locked down. It would boot into Media Portal and if you exit or do anything, the thing would just shut down. For all the other crap that someone might want to do on the thing, I'd have a seperate hard drive that they can boot into and screw everything over on. The other hard drives would simply be windows encrypted and user locked so they wouldn't be able to screw them over.
For now, just kick him off, but a seperate HD would never be too much trouble.