Additional to the already provided answer I'll point few things out and a TO-DO list

Start by getting him off your network.

 1. Turn off your Wi-Fi.
 2. Change your router admin password.
 3. Change the security to WPA2. *
 4. Disable WPS. **
 5. Change to a long password easy to remember. ***
 6. Use whitelist instead of blacklist. ****

*If your modem is old, then it might not have WPA2 personal, try WPA instead. (**History note**: WPA2 needed a hardware change from the old WEP standard, while WPA just needed a firmware update)

**If your router is old WPS have many vulnerabilities, and there's no need to have it available, just connect your devices the normal way.

***You got 63 ASCII, use 3 or 4 four words, add spaces (generally spaces aren't common in charsets), special symbols are hard for humans to remember but easy for computers to "guess", so use only one.

****Add your three devices - This will eventually render useless as previously stated that spoofing MAC is easy.

Whit all this, the bad guy would have more homework:
With no WEP he can't capture/break WEP weak IV's, with no WPS he can't use wash/reaver to get the PIN or pixie dust attacks, etc. With WPA/2 he needs to capture a handshake (now WPA) from any of your devices, bruteforce it (hence the long password-This maybe will take months-years depending on the length), then eventually when trying to connect he will spoof any of your MAC address and then he's in. **Hope this helps in any way.**