* depending on what data was there it may be possible to file an early tax-return, thus they could capture your fathers tax credit if applicable. File on the appropriate date.
* monitor his credit. This can be done for rather cheap or you can pull them manually.
* often, they will capture the contacts of all of your fathers correspondents. This is often a vector for follow on scams. They typically use this as an infection vector or to ask for money in the typical :relative in danger abroad" type scam.
* reinfecting the computer periodically and asking for follow on help.
As mentioned, it is probably a good idea to dump the entire hard drive and reinstall the operating system after backing up only necessary files/data. I ended up buying a mac for my grandmother, but others suggested google chrome / chromeOS type operating systems as they often limit the users ability to compromise the machine but have a limited tradeoff vs. their actual requirements.
If you have any follow on issues, as someone who had to deal with this like 2 months ago, feel free to shoot me an email if you have any other issues: klevvver@icloud.com
I'd do a quick google on the make/model/OS of the system to see if it ships with a restore volume. If not, walk him through the DVD restore.
My take is that the only way to assess the level of compromise is to see if Intel's Asset Management Technology [1] has been enabled. That means looking at the BIOS. It might be easier to ship the computer back and forth than to walk through diagnosis and repair.
Good luck.
[1]: https://en.m.wikipedia.org/wiki/Intel_Active_Management_Tech...