This is a practice called "blind reference check" where employers contact members of the candidate's professional network. It is usually done today by selecting contacts on linkedin, but it could be done the old-fashioned way by using professional contacts the employer keeps in touch with.
This kind of reference check lies outside of typical HR channels and has the benefit of giving "candid" information but the drawback is that people may just say whatever they want with virtually no consequences for exaggeration, bad sense, or outright lying. The onus is on the employer to perform these checks properly with some sophistication. Obviously the employer botched the process at the start by making an offer before checking all references.
FWIW, If the bad reference came from a linkedin contact (possibly even a second degree contact), it might be worth it to try to figure out who it was and sever that connection in case it happens again in the future.
Blind reference checks are only going to get more popular and that requires people to be careful about "curating" one's linkedin contacts. Employers also need to get better at approaching these types of checks and not take everything at face value.