Why don't you tell people what he did? After all that's the kind of information they're looking for and it doesn't really seem like he saw the error of his ways.
I don't know if it's a real issue or not, but I've heard before that giving a detailed report on a past employee's misdeeds can open you up to litigation, especially if you can't prove your claims.
You could always respond to reference calls by saying, "I'd love to tell you all about him, but don't want to open myself up to litigation." That sends a clear message without you having to say anything.
Just say "He worked here. I do not recommend his services".
That's not a particular statement about the person, it gives no version of events. If pressed, explain that this all you can say. You simply don't recommend him.
