Is the site just a site, or does it come with a service contract?
Either way, this should have been discussed up-front (pre development). Now that the cat's out of the bag, I would say that if you want to possibly retain them as a client you should release the files to them. At this point it may just be a trust building thing for them. But you should attach conditions to this...
I assume you have an hourly rate you charge them for updates/modifications? My approach in the past is this. My normal hourly rate is $XX, if I release these files to you, and you or someone else goes in and makes a mess my hourly rate doubles (or other increase) to fix anything that was broken by the other developer.
Sometimes this opens their eyes to the fact that stuff can go wrong when they let the bosses nephew go in and start working on your finely tuned scripts.