Oh yeah, it's not remotely legal by any standard whatsoever. The problem is that it's virtually impossible to prove.
In my friend's case, she was at the director level of a large publicly-traded company. Particularly as you approach the top of the that kind of corporate hierarchy, the world becomes very small, and good-old-boy dynamics start to dominate. There's no formal blacklist, of course -- just the opportunity to meet your frenemy from her previous employer down at the bar, where he can confidentially warn you to "watch out for that one: she's a troublemaker". Nothing more needs to be said, and certainly nothing needs to be written.
I suspect that hiring decisions at lower levels will be both more process-driven and better-documented, so it might be more possible to prove the existence of blacklists there (even if it's still far from easy). But near the top of the pyramid, I have great trouble seeing how the punitive legal action can realistically be used to break up the good-old-boy network.
Seeing this play out has actually changed my mind on the necessity of having gender quotas for management and boards. Previously I'd been opposed on vaguely libertarian grounds; now I see it as the only practical way of disrupting the good-old-boy networks that genuinely do a lot of harm. (Society is genuinely damaged -- depriving itself of so much talent -- by systematic bias against women).