Well outside of stealing his password (not 'word' but password) with a keylogger or tricking him into giving it to you there are ways to get his account frozen without his password. For example making lots of obviously fake accounts (as in 5 on each email, all from same IP, nothing ever done in accounts, made in quick succession) with his referral, although it might get your IP banned so use a proxy and such freezes are sometimes successfully appealed. Really if there was a way to just get someones password most people would use it out of greed not spite (as you probably would) and the whole neopet's economy would've collapsed by now
Yes and? Moving past that really what do you expect asking such questions without first thinking them through?