My first reaction on reading this was, "What about the Unsolicited Goods and Services Act and similar legislation?" However, a few minutes of Googling and reading up on contract law on Wikipedia suggests to me that there's a very real problem here. It turns out that unsolicited goods and services legislation only applies to consumers: for B2B it's somewhat more complicated.
For a contract to be valid, four things are necessary: an offer, an acceptance, a consideration, and an intention to create a legally binding relationship.
You can't accept a contract just by reading it: you have to take some action indicating your acceptance. Normally this would be by communicating it, but in the case of unilateral contracts (e.g. software licence agreements), it can be by some other action such as clicking an "I agree" button.
I'd guess that what is going on here is that the recruiter is trying to argue that you've indicated acceptance of their contract by hiring the guy. I'd guess that a paper trail to another agency would give your case some weight, but I'd guess that YMMV on that one.
This is why non-trivial companies have HR departments. The way they get round this one is by having clear disclaimers on their jobs/contact pages repudiating any liability for unsolicited CVs. Here are a couple of examples that I've come across - KPMG: http://www.kpmgcareers.co.uk/experienced-professionals/agenc... Cargill: http://www.cargill.com/careers/notice-staffing-agencies-plac...