From a plan perspective, was his next deferral a negative $750? Is the plan and his account square? It is unclear from your description if all the required +'s and -'s have occurred. As it was last payroll and probably the last business day of the year, I don't think earnings are an issue, no more gap period interest, right?
I think the bigger picture problem is that you have an individual, especially in a large company, who was able to manipulate his W-2, payroll and 401(k) on his own without any apparent oversight or controls. If the cash does not reconcile to account and/or payroll records - it may or may not show up on plan (CPA) audit or IRS audit - but if it does, I think the issue is much greater than a compliance limit.