"Or should I just drop it?" - yes, this. It's over.

As you weren't there, and I assume you haven't spoken to him about it, how do you know there isn't an innocent explanation to this?

I'm just wondering what poor ticketing system you're using where an admin can't undo the action person X did on date Y. (Or at least, select any ticket he touched on that date).

@flexi - I've spoke with my manager and know the former co-worker did this - we have audit history to prove that and plus he admitted it to my manager right before leaving.

@abigail we still have to do that manually for 100+ tickets. Still a lot of work.

I wouldn't recommend contacting the new company. Let it go. I would recommend contacting this person and let them know you won't be able to provide a reference in the future due to the impact you're incurring from unprofessional behavior.

@JoelEtherton if that was an answer, I'd vote for it, because that's exactly what I was thinking.

Talk to your corporate legal counsel. My bet is that they'll tell you not to do it because this could cost your company a lot of money in legal fees if he got fired as a result.

As a secondary note on this, you may learn a lesson here - leave providing references to the line managers concerned. They know what they can and can't say and also know what the company polices are around this.

This provides no tangible benefit to you, just more time wasted

@JoelEtherton you can still provide a reference, just not a good one.

@hanshenrik: "won't be able to" is my polite way of saying "I refuse to".

"sabotage" is overstating the case here. I don't see an attempt to destroy the company, I see a (seriously) misguided attempt to play a joke, in which he seriously underestimated the effects.

Can you add your location to the question? The legality of what you're asking about appears to depend on local laws.

@StephanBranczyk This is meaningless advice. Corporate legal will always tell you to not give a reference (bad or good), regardless of the person or circumstances. Simply because there is no upside for the company. Just don't even ask them. In cases like this you probably prefer to give the reference over the phone than email.

@Abigail I agree with Abigail that any half-decent ticketing systems should allow you to undo this change pretty quickly, like within 15min. Hence calling this 'sabotage' seems going berserk. Is the company simply trying to exaggerate the impact? If the company uses a dysfunctional ticketing system, or never configured it properly, that's not on the ex-employee. Maybe they illustrated a useful point; if one person could do this, others could too.

... As to whether to give a reference, I'd judge it on the totality of their work. This sounds like the IT equivalent of toilet-papering a car or banana up the tailpipe. 'Sabotage' would be pouring iron filings onto the servers, or trashing backups.