Business and personal email account has been accessed. Can I block IP Addresses from accessing email account?

My friend has an small business acct and a personal email acct. w/ yahoo. They are accessed by using the same yahoo ID. He recently ended a relationship. It hasn't been a happy ending. His estranged girlfriend has somehow stolen his password and has gone in and changed it. Knowing more about the internet and computers in general than he does I have been given the task of setting up his account with a new password.Not too tough right? WRONG! She has replaced his credit card with hers and everytime I go to lost password and type in the security questions. I end up getting the account back up and running for a few minutes. But when I go to log back in she has changed the password again. My friend spoke with yahoo today they sent a new password(basically what I have been doing) to a different email and advised that once in we change the zipcode. Making the account non-accessible to her. I think she had the account open when I did this because 20 min. later I cant get on again. Help please!

Sounds like big trouble. You can't prevent her from accessing the Yahoo website or e-mail, Yahoo will have to do that for you but they won't since it will be impossible for them to keep track of all IP addresses she can use (like from home, her work, friends houses, internet cafes, etcetera).
As troublesome as it may be, my advise would be to change everything: get a new account (preferably not with Yahoo, since she knows he might be on there), with a password generated through a program (rather than setting one up yourself) and let everyone know your friend has a new e-mail account. It could cost him some business, since some of his clients may still have his old address in their accounts, but in the long run that will be better as having to keep fighting over getting the accounts back up and running over and over again...