i know this is going to be a long shot, but see if hes using webmin. webmin has a bunch of back doors and its easier then most to crack.
or see if you can log in via ssh, people like that have real common passwords.
i use to run a website on vmware so i feel your pain on trying to see what cluster its on, you cant just take one part down, in five seconds its up on another one.
the guy's a nut job, we can see this, but the hosting co is getting cash money every month, it's going to be hard to convince them to close it down.
just my 2cents.