I see three options:
1. Keep the car and sell it with full disclosure a) clean carfax , b) I bought it CPO from BMW, c) it is pretty much flawless, there was a minor issue with the front right corner which BMW repaired for me, d) I do not know what caused the issue in c). From there, let the chips fall where they may. Some buyers will be totally anal and and not be interested in 'damaged goods', some (like me) expect a used car to have been 'driven'. If they are properly repaired I have no issues.
2. Push it back on the dealer, you should be able to get the name of the previous owners from a title search. Track them down and find out what damage the car incurred. Your 'friend' should back you on this. It is an honesty and disclosure, they failed to meet a reasonable standard. Full refund or an agreement to share the 'hit'.
3. Keep it for yourself. Drive the snot out of it.
Carfax wont show an accident that the owner paid for out of his pocket. So it isn't a guarantee of any sorts, just an 'indicator'. I put zero stock in them as a buyer.
Do not involve a lawyer, other than to write a single threatening letter if you choose option 2. above. It just isn't worth it otherwise.
Lastly, Even if you lose a few grand on it by being honest your reputation will remain intact. In your business that is a small price to pay.