Find multiple Mac address on a single interface

We recently had an issue where someone connected an unauthorized desk switch to their network port under their desk. The way they connected it caused a loop which caused every connected device on the stack to randomly drop until we were able to identify the problem interface, then track it to a desk. 

Is there an alert that can be setup to identify when 2 or more mac address's reside on a single interface? 

I am relatively new to networking so I am seeking to learn the (work smarter not harder) ways to identify possible issues before they become issues.