An rpmlint check. Then we can catch them as they appear. If anyone has shell access to a mirror (or we do), a grep should find the victims quickly enough