> you can't just block their access to the internet

Or maybe that's the best thing you can do for them, perhaps preventing them from revealing even more passwords etc to the attacker.