Here's a query I wrote up awhile ago that does something similar that lets you filter on the username or the database if you look at the dm_exec_sessions table. There's a link below that will walk you through setting up alerts and emailing on SQL Server. The 300 in the where clause is seconds for where the query has been running.
You can set up resource governor to limit his CPU or RAM per query. You can put into effect stored procedures or triggers to automatically kill his SPIDS if they go over, but that gets dangerous. I'd start by limiting resources and alerts to manually intervene.
Ideally, you can go and teach him how to properly query without bringing down the database.
'SPID=' + CONVERT(VARCHAR , a.session_id) + ' has been running the following for ' + CONVERT(VARCHAR , DATEDIFF(SS ,
' seconds: ' + CONVERT(VARCHAR , b.text)
,CONVERT(VARCHAR , DATEDIFF(SS , a.start_time , CURRENT_TIMESTAMP))
CROSS APPLY sys.dm_exec_sql_text(a.sql_handle) b
INNER JOIN sys.dm_exec_sessions AS c
ON a.session_id = c.session_id
a.status <> 'background' AND
DATEDIFF(SS , a.start_time , CURRENT_TIMESTAMP) > 300 AND c.login_name = 'username' AND c.database_id = 'id of database'
Source on setting up alerts
Source on sessions