If the website doesn't require any database then simply create a new FTP account and give them access.
But if they need database access then you can create database in control panel and then give them user/password. Problem is they will probably need DB control panel to to create tables and manage it and the thing is 1&1's database control panel cannot be accessed without first logging into 1&1 admin. This is true for most Linux hostings that uses CPanel. So in case of database you may also need to create a sub account for 1&1 admin through which they can login and manage database.
IMO that would be a huge issue with me - and a good reason why people should separate their registrar from their hosting (don't worry OP, I used to use 1&1 as my registrar and my host - I'd say within a year you'll be looking for other options :smilewinkgrin
.
Creating a sub account isn't always an option, especially with lower end hosts (like 1&1) - they're cheap for a reason.
If the site is really worth it, look into an alternate option, maybe a separate hosting account (for one site you might be able to get one for as low as $5 a month - maybe even less) this way they won't have access to your domains and other sites.
And yes Acro, it is all about trust. Unfortunately there are a lot of malicious companies out there who try to take advantage of the less educated. I manage the domains for someone while they went with a different company for development and hosting. I had to fight with them because they claimed they couldn't do anything without me giving them the login and password to my registrar account (yeah, sure, I'll give you access to all of my domains even though I don't even know you). I even told them I could point the DNS and they claimed that it wouldn't work. Of course, oddly rnough they gave in and gave me the DNS and the sites have been working perfectly since I changed them.