You need to tell them ASAP, it will suck a lot. But it will be even worse if they find out you LET them have their friend contact the school.

As you said all options are shit, but this is the option with the most integrity on your part.