Read this too!
The Wifi Pineapple is just one device a person can use in these situations.
I'm not sure what kinds of reports you have but, if the person is using a portable Rouge-AP they are most likely mobile(walking, biking) or, static but, within proximity of your AP's(drinking coffee, or on a laptop or, even a smartphone)...
It gets really dangerous because when dealing with portable rouge-AP's like the wifi pineapple it becomes apparent that the person your interested in is in fact, amongst your company...An insider.
So, you combat a mobile threat like this YOU need to get mobile. Already people have suggested downloading apps for mobile smartphone w/ wifi to scan for rouge-AP SSID's. Even if they are spoofing the SSID a mac address can also be pulled, and assessed(this will give you the device origin)[CAN BE SPOOFED}.
HOW: WARDRIVING/WARWALKING You will need a list of your wireless assets current hardware MAC address, and walk around with multiply cellphones with wireless scanning apps going, and a list of wireless MAC addresses. You can all pretty much look incognito because, no one thinks just a smartphone can accomplish things of this nature.(in reality, even a wristwatch can now compromise a wireless network...) OR, it can be used to scan wireless signals, and look completely inconspicuous.
Your suspected attacker is trying to stay under the radar as well. This may only be a compromised remote router as well, acting as a wireless client bridge or a Karma rouge-AP. If you go wardriving, you can use a laptop(suggested multiply persons w/ multiply laptops) with windows running InSSIDer. Grab the MAC list, and go out scanning. Put your MAC address list in a notepad, and check it against the AP's your discover.
Another option is forcing the wireless spectrum to do your bidding(in a legal way)
Tactical De-authentication attacks are the next wave in securing wireless from these kinda of threats though, its still emerging...
All I can tell you is that I have a wifi pineapple, and it is insane what you can do with a few clicks now... You need to stop this threat ASAP or it might be to late, and your corporate network is under hell-fire. Cellular phones with wireless capabilities are also a threat now... Your average smartphone can also become a rouge-AP, and sniff traffic, strip SSL...
In the future, I suggest your company look into wireless IDS/IPS systems that are commercially available today. Some, even have all the defense tricks I said above. ;-)
Good luck to you on this!
Feel free to contact me I can help!!!