I would first get his IP, not hard if he's known to you, and then keep the pages as is for his ip or subnet, or even his region using a geoip script.
I'd then turn the entire site into cloaked pages, doorway pages, meta refreshes, pop-ups, iframes, hidden iframes and 1px iframes based on ip. He sees the site and it looks normal. Everyone else, including Google, sees everything they hate. He gets sandboxed and he has no idea why. (Also add meta tags of no-cache meta tags.)
I'd maybe even direct all domain requests to a 404 apart from his ip, which would also be cool.