It seems that the problem or the failure here is that there was a bad actor who provided fake letters, yet the department did not recognize that early and was unable to identify that in other cases.
Does the department, then, once it finds a bad actor, go to the other cases? Why didn't these students know that? How come that wasn't found?