Tactics I saw included fake interviews (cancelled at the last minute; in some cases with places I knew people so I definitively found out they were fake), being forwarded to positions without consent, modifying my resume, pocketing pay raises from the employer (this was a contracting ie hourly/daily rate type deal), being told they were putting me forward for something when they didn't. Honestly the list goes on.
So it's been more than a decade since I lived in London and I STILL get emails from some of these agencies (luckily to a now largely abandoned email address).
Nowadays, at least in tech, I wonder if you should ever talk to a recruiter at all. The big guys do direct recruitment. Smaller startups tend to be via existing relationships and word-of-mouth (at least that's my impression). And in my experience company recruiters are orders of magnitude better than independent recruiters.
On the subject of references, it's been awhile since I've had to deal with this, but the principle of being prudent with revealing your references resonates. In the past I've only done this as part of the company's due diligence after accepting an offer. No one is going to seriously check your references when you're still a resume in a pile. I can totally see recruiters cold calling references.