An ISP has a stock of IP's.
And from that stock, the IP is being changed.
So if we firewall an IP the stock ip's will also get Banned.
So he if he changes his IP also just his Ip will be changed from any one of the IP from his ISP's stock provided to him.

And here this guy's IP is wierd.
Use /ip and ask young to firewall it.

So his stock ip will also be firewalled even though he changes.
But note that he can enter server using another ISP.