I'd have a little word with him too. Damn cheek of the man! Thinking about it though changing the passwords etc though will let him know you *know* what he's been doing, perving away. Or, maybe you could check the history of visited sites etc, print out the list of recently visited sites and put it up near the computer. Next time he visits to use it he'll find out you know exactly what's been going on! Also second the Adaware suggestion, might perhaps like to use
SpyBot, more powerful and better at removing diallers, keyloggers and other crap he's probably allowed access to your pc.