If you have made an application, identifying two academic referees, does that company have the right to contact someone else at the university whom you did not name?

No, they can only contact people you have given them permission to contact.

Absolutely not!