I can't answer your query about the possible hack, but I can offer a temporary suggestion.
Record his email address, username combinations or whatever, delete his account and enable moderation of new user accounts. That way you can try and keep him out until you find a proper solution to getting rid of him.
Also, do you have any record of his real IP address from one of his earlier posts? If so, enter it
here and you may find an email address you can use to report him to his ISP, and they should be able to completely block him from your site.