Before any action, you need to consider :
Motive and professionalism
This is only partly about whether this was this done maliciously/knowingly, or literally just as a prank. Given his standing/experience, surely he should have known the real world impact, and shouldn't indulge such pranks anyway. So you and others have to decide first, how serious was the lapse, whether deliberate or reckless. If he'd stayed, would you have fired him? Disciplined him? Told him he was a dick, and don't do it again?
Recklessness and poor judgment can be just as bad as malice,if a person is prone to repeat. The key question is, you've known him ages now. So how does this reflect on his overall reliability and professionalism? What is a balanced view?
If this is a severe enough issue to reflect materially on his professionalism, what should you do about it
You have options.
- You gave an honest reference, and can maintain that position. You may have no obligation to update a reference after its issued (but check legally, as he was still an employee!)
- You may feel nothing happened that merits a reference anyway, and he was still a valued employee if he had chosen to stay.
- You may feel that having verbally confirmed the reference, knowing it was being relied on, that not disclosing that you now have new information, could pose a legal risk in the eyes of HR or your lawyer.
- Or you may feel this tarnishes him so much that ethically and as good practice, it needs something done, or you can no longer stand by the reference.
Bear in mind that anything said, is nuclear. You could merely say there's a mild question over his departing conduct, and it'll sound like a terrible thing, because if it wasn't terrible, why would you have reached out? The other party will demand full details, again, why would you begin to warn them only to partly do it. So this is all or nothing, burn to the ground or leave alone.
I can't say which of those to follow, but I have 2 points to guide you.
- If you feel inclined to contact the 3rd party, get the advice backing the decision from your lawyer, not just HR. And get it in writing. The scope for litigation or other backlash is just too high not to.
- If you do say something, maybe phrase it as, "we miswrote the reference and wish to withdraw it (or withdraw and replace it)". Or that an on-file draft was accidentally sent and not a final one. That at least gives you some scope to not nuke everything. Perhaps.