|Your nephew can make another user account that has administrator rights at any time if he can access any account that has administrator rights . |
Don't let him use another user's account that has administrator rights, unless you or someone else is there watching what he's doing.
If all the users of the computer when it is booted normally have passwords he doesn't know, the built in Administrator user has no password by default. If you make a password for that, that is good enough that he isn't likely to be able to guess it, he can't use that Administrator account.
See the info at the link in response 2.
However, if he's really determined he can find other "cheater" ways to make an account that has administrator rights.
"He may have simply changed a screen name so be careful."
In that case, the original user name is not changed at C:\Documents and Settings\(the name of the user account).