Website trouble

so there’s this bad situation going on with one of my friends. he made a deal with a girl to build him a website for his band, no contract involved:sigh:, and had paid her 200 bucks to setup the domain name and server. the girl set it all up and had made them a page with a picture of the band and a bio. not trying to be mean or anything, but the site looked horrible. so i told him i would make him a functional site for free. the problem is that when he told the girl that he was going with someone else for the site design she freaked out. she said that they owed her another 400 bucks for the work she had done. so now she won’t give them the passwords or username for the server and put this up on their site. the sunset curse .
is there anything they can do besides forkin over the 400 for the passwords. or are they screwed?