Go into system setup (also called CMOS setup). You do this by pressing either the DELete key or F2 key (or F10 if you have a Compaq usually) right after rebooting the computer. If the Windows screen starts loading, you're too late. On the first black screen when the memory is checking itself, it will often say 'Press [key] to enter setup.' Press it 3 or 4 times while the computer is first booting.
Once you are in setup, there should be a tab to take you to Security. You can enter a user password there which should prevent anyone from getting into Windows. Follow the on-screen instructions to maneuver thru set-up and save your changes. Make sure you remember this password...it will need to be entered everytime the computer starts up. There is a way to get around this, but I won't post it here.
Even if your ex can get into 'Safe Mode,' that won't help him as far as using internet goes, or most Windows programs. The Windows drivers do not load in safe mode, so most applications will not work. A few programs, like utilities, will work, but internet won't.
ps- time to get a new roommate. If you are wise, you won't make it a new BF.