This woman I assume works on an HR dept for one of the companies your boss sub-contracts you to? She has no legal right to carry out a CRB check without your signed authority as i understand it. She will not have had that from you, therefore this is either here say, rumour, or defamation of character by person or persons who may have a grudge against you or your boss. If this woman who sent your boss and the other 2 companies the email is NOT in the HR dept, then it is malicious on her part as that is not her job role