This is why I, as a coach, am not allowed to directly contact an athlete on social media, by text, phone, email, or any other way. I must go through their parents.
Here, the first red flag is that contact.
You also need to take 3rd party reports seriously. A colleague of mine reported a co-worker for texting an athlete (she was 16, him early 20's). The welfare officer investigated, he was asked to show the communications, if they were about training times etc he'd have warned and had to do his safeguarding training again.
As it was, the texts were crossing the line into a personal nature so the welfare officer reported him to her superior. It turned out he'd been the same at his previous workplace.
He is currently prevented from working with children.
You just can't take risks with children. We all do safeguarding training and we all know what is and isn't acceptable. Cross that line and your job is at risk.