The server has a cgi script so it shows a blank index.html instead of a 404 or no permission or whatever error.

The only way to stop it is to get have the hosting provider stop it...if they are willing. Considering he wants to upload music, you can be pretty sure that the hosting provider will not allow it, unless he is uploading his own music, not things that fall under the RIAA