I agree...here it takes either the ex-employee's signature/authorization, a court order OR a subpeona. You just never know who is "posing" as someone who needs/wants information that they should not be allowed access to.
I had a policeman call last week about a recent terminated employee. To give him the information he asked for, I required that he send me the request in written form on the department stationary. And I cleared it with our corporate counsel first.