Here is the deal, you could talk with him as the previous commenter indicated and see what he is trying to hide. You could have set up a secondary password recovery email on his GMail account, but if he's savvy he could very well just remove or change it. Plain and simple, other than revoking his internet priveledges, its kind of hard to do what you're asking