Normally, a switch should not fail back into 'hub' mode unless you have overloaded its MAC address table (normally around 8,000+ MAC addresses, but check the make/model detail). You can check the number of MAC addresses on a given Cisco switch with this command:
sh mac-address-table | inc Total
Switches make all of their decisions based on the vlan tag (if you're using them) and mac address. If you are getting flooding then you need to look at why the switch isn't building an accurate mac-address-table.
You can get this behavior however if you get what I call 'vlan bleed'. If you have two switch ports connected back-to-back, but on different vlans you could see this behavior.
A device with multiple network cards could also be bridging vlans together. Microsoft had a 'feature' to bridge network cards so your wireless and hard-wired networks would be bridged for instanance.
Look at your mac table for ports with more than one address that are not uplinks to another switch. You can also follow the MAC address of one of the devices that should be unicast through the MAC tables of your switches.
On Cisco switchs these commands may be helpful:
sh mac-address-table | ex CPU
sh mac-address-table | ex CPU|<uplink port name>