I used to work as a recruiter (not anymore, terrible industry), and one of my colleagues actually sent a candidates CV to their current employer without their knowledge or consent. Things like these happen, because many external recruiters don’t take enough time for you when you’ve only just started working with you and they don’t know whether you’re “loyal” to them or just want to know your market value.

And yes, references are used as leads. We were advised to call the companies and offer our services and to headhunt the people. There are SO many black sheep in this industry (such as my old company), and very few trustworthy ones.