Funny, but at the same time, that could also get you sued (or potentially even prosecuted), and nobody would have much sympathy for you.
But ignoring all of that: hot water is dangerous and can cause full thickness burns in seconds.
http://www.accuratebuilding.com/services/legal/charts/hot_wa...
At 60 C you'd have full thickness burns in 5 seconds.
Don't actually do this, you'll likely end up with serious disfiguring injuries such as:
>Liebeck was taken to the hospital, where it was determined that she had suffered third-degree burns on six percent of her skin and lesser burns over sixteen percent.[11] She remained in the hospital for eight days while she underwent skin grafting. During this period, Liebeck lost 20 pounds (9 kg, nearly 20% of her body weight), reducing her to 83 pounds (38 kg). After the hospital stay, Liebeck needed care for 3 weeks, provided by her daughter.[12] Liebeck suffered permanent disfigurement after the incident and was partially disabled for two years.[13][14]
Basically very hot water is dangerous and it's much easier to get a serious injury from it than you'd think.
As someone who used to process accident claims for a large insurance company, I will suggest that if you spill hot water in your lap in a public place, you are probably not going to whip the clothing off right then and there to protect yourself from the burns. She is also elderly and elderly people have slower reflexes and can be more vulnerable to all kinds of health issues.
And they'd likely win with that argument under the CFAA. Even if they just handed you login credentials, they did so in the context of you fulfilling a specific task. From a technical perspective, those credentials might give you root access that lets you do anything. From a legal perspective, that's not the same as giving you authorization to do anything. For the CFAA, this would likely constitute "exceed[ing] authorized access." Not to mention that taking down a site (or just defacing it) is, on its face, clearly against a client's interests.
In any case, you're using the threat of damage to force payment. Even if the client owes you a valid debt, those threats can likely be considered extortion. The sort of jerks who will gleefully screw over a freelancer because, as they so kindly informed you, "no one will listen to you" are often the sort who have no problems with screwing you another way.