I strongly suspect you are right.
Bobby - Please don't take this personally; I'm moving on from your request to make a wider, more general point, not directed at you, but for others who may be reading this thread.
But it's not likely to. If the competitors site is 'clean', and he's careful who he links TO, then 5000 bad incoming links won't hurt him.
Google does not hold you responsible for incoming links unless they are part of a link exchange scheme or similar.
I'm loosely paraphrasing because I've lost the links to Matt Cutts' quotation. You don't have to believe MC, of course - but no-one has actually demonstrated that he's lying (or suggested a motive!).
A 'small drop' could be to avoid alerting the victim to the subterfuge.
But all the techniques mentioned here (and several not mentioned so far) cannot be focussed so carefully, and will almost certainly fail - or (temporarily at least) cause major change in the serps, thus alerting the victim very quickly.
There are ways to attack a web site where you cannot 'reciprocate their links' or change 'on page content' (the clues are in the question).
But their success cannot be guaranteed, even after much hard work, and retribution can follow if the victim finds out what's occurring.
Even the Blackest of Black Knights, using their best (worst?) skills often fail (according to their confessions in the late, unlamented ThreadWatch), and they'd certainly not display their wares here in open forum.