On a big enough network it will eventually happen and yes it sux :-( Thankfully it was someone else's headache to fix.

I've seen a fellow stumbler myself already. At least it looked like it - Peer connection with a MAC consisting of all Fs if I recall correctly. I'd have to check my logs to see but it was definatly a hacked MAC! Will have to see if I can do the beef thing when the laptop is rebuilt. Wonder if different hardware will want a different set of chars up front or not..?