Aah, been there, done that :-)
First check that router to make sure it is not accidentally configured to act as dhcp relay (this feature is also known as ip-helper).
But the most likely cause is a user that (intentionally or not) connected a hub or unmanaged switch between ports of both LAN's.
If possible configure port-security on all access-ports (not on the up-links or on ports to which access-points connect!) of your switches for a relatively low number of allowed mac-addresses (5 or so).
This will cause the offending port to go into error/disabled almost immediately.
So you can easily tell which port has the offender and it will prevent any further re-occurrences in the future.
Then go hunting :-) I have found that walking into the offenders office with a baseball bat really gets their attention.