It boils down to the fact that if he is an admin - either of the local machine or the network, then there is nothing he can't do.
Exactly! and this is compounded by what sounds to be a physically insecure environment.

If someone has unrestricted physical access to your machine they can easily own it.

All I can suggest in that situation is to use a removable hard drive and watch out for physical keyloggers.

Any banking details are sent over the network encrypted so if he is getting these he must have something on the computer that is reading your keystrokes - likewise when you go to hotmail make sure you go to https://hotmail.com (put an 's' after http) and this will encrypt the traffic, in case he is sniffing it over the local network instead.
That as well. Also remember that all current accounts have been compromised, so the passwords will need to be changed. Otherwise all the attacker has to do is log in as the legitimate owner?