The word hacked is often misused for a situation where often misconfigured permissions (by accident or missing knowledge or misunderstanding or Admin groups above the ServerQuery Server Admin) allow user to do more than they should be able.
The only way to ensure he has no hidden permissions is a permreset to reset all permissions on whole virtual server.
But when he has the login data for the Serveradmin login, then only changing it’s password will help.
About his account…
I’m not a lawyer and this is mostly a forum for tech support, so following about law forcing us may be wrong.
We are not giving out data about our users as long they don’t want us to do this or anyone who represents the law would force us.
So whenever your authority forces us this may change.
