The MAC address filtering should be working, unless he's spoofing his address, is torrenting from a device you're not blocking (cell phone, tablet), or is using a NIC that you're not accounting for. We have two routers in our home, and on both you have the option to either:
- Block specific MAC addresses from connecting, or
- Permit only the MAC addresses you specify to connect.
If your router allows the latter feature, have you given it a try?