Hosting is different than domain name registration. Your registrar - like GoDaddy, Namecheap, Network Solutions and Register.com are all places where you official register a domain name. If it's an account in your name, you have the ability to login and make changes, such as by whom and where your website will be hosted. The registrant is the legal owner of a domain name.
Your hosting is where your website is physically located. Think of your domain name as your phone number and you can move your home anywhere - to Verizon, AT&T, T-Mobile or Sprint. They provide you with service for the phone number. If they have held that part hostage, the only issue you have is with the physical files for your website, which you should have a copy.
With regard to hosting costs, if you own both of the above - which you should - your IT person should not be able to restrain you from moving where you host and your data. If the bill isn't paid they can shut down the service, essentially ending your website appearing and your being able to login. That's about the extent of it.
My guess - your IT person registered the domains in his name. This happens often and typically as a result of fraudulent misrepresentation to the unsuspecting. You just know if it works you assume it to be yours. You should use a WHOIS database to determine who is the actual legal registrant. Good luck with your legal issue.
