Just an update- I had emailed webkinz (support@webkinz.com) and they sent me a customer service number and a pin. I called and talked to a very nice Canadian

. We decided that it had to be someone who guessed his password (which wasn't very secure and we've since changed to a more secure one - who thought we'd have to worry about 9 yr old hackers?). Anyway, when I asked him about losing his exclusive items, he asked if my son was missing items. Then he looked in his records and it showed the user name of the person to whom my son's stuff had been sent (I didn't even know you could send stuff to other people). So this "friend" of my son hacked into his account, changed his room themes to princess themes, sent himself the good stuff, and used up my son's kinzcash and bought princess stuff. I'm sure he thought it was funny, but it wasn't. The CS man told me the username, so I know who did this now. The CS man is also going to credit my son's account with some kinzcash to make up for it, which was very very nice of him.
The CS man suggested I talk to the boy's parents, but I don't think I'm going to go there. It's a small town and it will turn into a big deal. A lesson for us to be very careful. I'm not even going to tell my son who did it, I don't think. He would probably get into a fight about it with him, and we don't need that.
Yeesh. Thanks everybody who responded - your ideas were helpful.