Depending on what version of Mac OS X, different methods are used to replace the Admin password, which then allows you to change any other passwords. He should have only a "User" account, with no right to administer or install software.
If you decide to ease back in, there are "Parental Controls" available that can limit sites available using a Blacklist or Whitelist, limit total hours of daily use, and enforce a curfew. You can also limit email correspondents. Some of this may be easily circumvented by using FaceBook mail or Webmail.