There is no absolute way of securing it. Active accounts are always tricky. Try finding out what times he is usually on (you can do this by staying logged in if he has no NFs online or if he is online, refresh every couple minutes to see if he is online). Then wait for a time when he is usually not online change the password and email and raid the account, make sure to send it to a couple different sides so that you have more of a chance of keeping some of the items. There is a detailed guide on moving items from an account to sides somewhere find that and follow it and you should be able to keep at least some of the items.
Another way of going about doing it is waiting until the account is inactive, since there have been more and more people quitting neopets everyday there is a chance that he could go inactive or quit and then you have nothing to worry about. If I were you I would wait if it has some nice items on it, but that is just my personal opinion.
