Not only should you unfriend and ban them, you should report them too to the site's staff because I'm sure that sharing your password/account with someone else is a breach of Terms of Service.

Screencap the PM if you haven't erased it, or at least forward it to Support.