How did you give him root access ?

Anyway, a better option can be changing ownership of the files in /var/www to the yourself : apache and adding the user to the apache group. Then permissions of 775 on the folder will give user the proper read write permissions.

There is no point of giving a user the root privileges, but to increase the risk to get your web server hacked easily...

you need to give a user some privileges so that if the user got hacked, it is still safe to avoid high risk of breaking into your server.

for what you are up to, read this and be careful when giving permission to user:

http://stackoverflow.com/questions/3740152/how-to-set-chmod-for-a-folder-and-all-of-its-subfolders-and-files-in-linux-ubunt

thanks!

so what I have now is:
1. root user. not used
2. admin account with root privileges. this is the main account i will use to admin tasks
3. web account which I have assigned to the www-data group and given him/the group permission to read/write to /var/www. this is the main account i will use to do ftp tasks

is this typically how user accounts are structured on servers? very new to webservers so still trying to figure out the correct things to do

That looks proper :] You might want to use sftp instead of ftp as it is much more secure: https://www.digitalocean.com/community/articles/how-to-use-filezilla-to-transfer-and-manage-files-securely-on-your-vps.

You can do that, it shouldn't cause any issues.