By the way: A bit of googling tells me that the way you harden your network against this sort of thing is to use managed switches and enable a feature on the managed switches called "DHCP Snooping", which allows you to firewall DHCP requests and only allow them to reach your own trusted DHCP server, and ignore all other DHCP requests.