Hi everyone, I'm new on here, but I am a bit of a loss what to do next. Here's the problem:

My girlfriend's son's messenger account is being hijacked ( we suspect by someone else from his school given the content of the messages sent by the hacker posing as her son). Simply put when he goes online, within seconds he is logged out and when he tries to go back in it says he is logged on another computer, then his password gets reset. Vile and disgusting messages are sent to the other contacts on his list as if they were from him. More over we have gone on and ‘chatted’ with the hacker who is pretending to be him, when we say that we know it is not her son the hacker becomes abusive writing thoroughly disgusting messages about my girlfriend. He has gone back in and changed his password three times to random sequences of letters and numbers and still within minutes he has been logged out again. He even tried creating a new messenger account and it happened with that to (which I presume suggests it is one of his contacts). It is the Messenger 7.5 with Windows XP Service pack 2 (all updates applied and up to date). They have up to date antivirus software in the form of PC-Cillin with it's own personal firewall. This has detected nothing.

I ran panda activescan and apart from a few cookies it only came up with two other forms of adware :

Adware:adware/oemji in the registry
Adware:Adware/WinTools C:\WINDOWS\system32\grwinsthlp.exe

Also ran hijack this and tried to put log in here, but said message too long.

Can anyone please help? Firstly to secure the machine and his account to stop this happening and secnodly is it possible to find out who is doing it?

Many thanks in advance.