I would be tempted to lie, and tell him you get paid the same whether they click or not. That way he wouldn't be tempted to "help" you with a click attack. But just saying nothing would be more honest. Do you have a record of this user's IP address? Keep an eye on your clicks, and consider informing Google of this email. So if that user does do a lot of clicking, you're armed with information and don't risk your account.