I would NOT leave him attached to the incorrect parents, as that simply perpetuates bad information.
I would choose between the remaining two alternatives in terms of the prevalence of mis-information elsewhere on the internet.
If the bad information is NOT prevalent elsewhere, I would merge this Thomas with the Thomas that he really is, and as a result the bad Thomas would disappear. I would, however, add a note with cross link both to the biography of the profile of "former" parents, and also to Thomas' profile, noting the existence of the false relationship and where it may be found.
If the information IS prevalent elsewhere, then I would keep the profile, documenting both why it is an error and also the source of the bad information. I would then process it (one week's notice on G2G) as a Disproven Existence profile. Once the week's notice has past, all links with other profiles would be severed. The fake Thomas would no longer appear in anyone's tree, but if someone tried to re-create it, they would (hopefully) discover it.