I tried everything from removing all users manually through SQL, adding new ones with full admin access (which results in creating an administrator that cant edit any pages/posts, or access users), to disabling all the plugins manually. I have a bad feeling he has hidden a lot of code throughout the site to be extra sure we’d never gain access. Extortion much?