First. He didn't "hack"
and to stop him from doing that again, set a PIN instead of a password.
Also, if he is starting to do that he may end up like the Script Kiddies that have been arrested lately (no offense whatsoever was intended)
He is honestly lucky it didn't break your system, because most of those tools are just password removers, and those most of the time you can't do anything about, because 9/10 of them are linux based, and linux has a higher runlevel than windows does.
you can also set up a picture login or use 2 step authentication.
if you use the latter than he will have a MUCH more difficult time removing the password.
SideNote: You may want to talk to him about that, let him the consequences of breaking into someones computer (15 years roughly) even if it's family he was not authorized to use it.
if he wants to learn about computers, buy/give/set up a simple very basic machine for him to play with, then if he breaks it, there's no loss, except for operator error.
(seriously, no offense whatsoever is intended, but it upsets me and people in my field when one doesn't fully understand what they are doing)
Hopefully that was helpful/informative.