Hi !
For illegally connected switches sending BPDU, you can enable BPDU-Blocking, shut down port and get syslog when receiving any BPDU
else you can use MAC-limit and limit the number of seen mac adresses to 1 or 2 ( if phones are connected in serial manner) and shut down the port and get syslog on violation.
regrads
alexander