Legal Question in Business Law in California

You could check with ICANN to see if this falls under cybersquatting or even trademark infringement (if the domain is the same as the school's trademark). Just so thoughts since I don't know the details.

If they paid him for the work, it belongs to them. They can sue him under a number of theories.

I assume your client would rather have the site than the money, and would rather get it back quickly and cheaply than after months of litigation and thousands of dollars of perhaps unrecoverable fees. Perhaps then the school could sue the webmaster in Small Claims Court for a sum of money, alleging money damages under one or more theories where Small Claims has jurisdiction, then offer to dismiss the suit, without prejudice, if the webmaster also agrees to turn over the password and deliver the site (get it in writing). This is not 100% certain to work, but if it does it will be months faster and thousands cheaper than going to Superior Court with a suit. There are good self-help books on preparing, filing and winning your suit in California Small Claims Court by Nolo Press and other publishers.

New case law seems to confirm that this would fall under the Cybersquatting statute. He cannot hold the domain hostage for his own gain. He can face severe penalties. Also, i agree that since it was purchased with School money for benefit of school, it belongs to the school under independent contractor theory.