Welcome to the forum,
I'm slightly confused as to what your exact question is, but I'll outline the general process which GWR are likely to follow.
They will at some point be in touch with your colleague. They are likely to have investigated journey history and will have backdated this the full four months. We regularly see backdating by two or three years. They may ask for details of railcards held in the past five years or so.
GWR are able to prosecute for this incident (assuming it happened recently) and it is likely they will threaten to do this. However, provided your colleague cooperates with GWR, they are likely to be offered an out of court settlement. This will usually be the anytime single fare for each journey undertaken without a valid ticket, giving no credit for any incorrect fares paid, plus an admin fee. The admin fee is usually somewhere in the region of £150, although it is good to be prepared for more than that.
If you're able to provide a few more details, such as those outlined
here, then we may be able to give more specific advice.
When your colleague recieves a letter from GWR, upload it to the forum with personal details redacted. If they hear nothing and 4-5 months has elapsed since the incident, it would also be worth mentioning that here so we can advise on next steps. When did the incident occur?
It may be helpful if you can convince your colleague to make their own account on the forum, as it will help to gain full details about the case, although this is of course not compulsory. We are friendly

.