I had someone I considered a trustworthy person as my co-admin at one point, they hijacked the site, banned my account and deactivated the forum until I paid them $1,000 for "graphics work" he'd done, which consisted of downloading the vB2 graphics kit that they used to have in the members area, changing the background colour of a few buttons and re-uploading them. Fortunately I knew how to get back into my database, change mine and his account roles, sign back in and IP ban him. That taught me to be more careful about who I pick as staff, but when you find out someone isn't who you thought they were, you definitely have to move to sort the situation ASAP. Letting it linger leads to problems.