You probably want a different site to truly answer the legality, but nepotism is generally frowned upon, but I don’t think illegal. How they went about it sounds more like loopholes and tricks than any real legal issues as well.
As far as what to do, it’s a matter of your motivations—morality? vengeance?—and your risks. Burning bridges is rarely recommended from a purely employment-based consideration. You might someday interview where he works or otherwise have your circles of influence mix. If it is just a dislike for the boss and/or his tactics, you’re better off dropping it and letting the company take the responsibility for enforcing its own rules around nepotism.
If the risk is not great enough to dissuade you and you feel some strong moral obligation, then let the company know. A simple call or email to HR could get the ball rolling, if they choose to act. If so, I applaud your convictions and can tell you that the times I took a stand in my career despite possible repercussions are some of the times I most fondly remember. I was never harmed by their outcomes, but each case is its own.
Only you can assess how important it is to you to punish this questionable behavior and how much risk of it coming back around to you there is. There are outlier considerations, e.g. might he snap and stalk you, etc. While these may be extreme and unlikely, it’s part of the equation to factor in.