There is no cache, so I think this is an over-reaction at this point by the designer and only discredits their business sense and will most likely result in not getting paid for this job.
The phrase 2 wrongs don't make a right comes to mind. WE already have a legal system in place to handle these issues, no reason to defame on the internet, which is truly a permanent record.
And... it may take years, at best. I did work for someone in mid 2008, they didn't pay (I should have had a down payment). I filed a lawsuit in NYC, and it's now 5 years later and it's still in the queue. If I was to get a judgement next year, it might be several more years of trying to collect before I get paid, if ever.
IIRC, they changed the passwords as I was delivering the final work, although, at the time, I didn't know it was the final work, because there was some other stuff slated to be done the following week which was 'put on hold'.
If you've ever had to sue someone you'll know that it's a distraction and not a magical solution to problems. Even when you get judgement, you've then got to collect and there are people that will drag their heels making your victory a pyrrhic one.
The person that didn't pay their web designer deserves to be shamed. You can argue that it's unprofessional of the web designer (and it probably is), but it's also unprofessional of the client.
Intellectual property rights are all the rage these days and that would mix into this.
That said, there are a ton of things having to do with the scope of work, reviews of work in progress, acceptance or rejection of completed work, and payment terms that are absolutly the contractor's responsibility. But again, securing clear title to the work is the buyer's concern, not the seller's.
I would love to see a single case ever where a company's domain and website were turned over to a contract designer due to a pay dispute.
The seller is not "limiting access". They are not taking away the work they produced. They are instead publishing defamatory messages on the client's domain against the client's will. They are essentially claiming the domain as their own, which is the real issue here. This wouldn't be an interesting or controversial story if nycfreshmarket.com was a white screen, or a coming soon type thing.