Method (Policy Based Management, DDL Trigger, whatever) to prevent logins with sysadmin from granting sysadmin to other logins
For whodunnit, there's a profiler trace event "Audit Add Login to Server Role" under security. Presumably it catches ALTER and not just the SPs specified, but that would need to be tested.

I'd suspect the guilty once caught would start assigning specific permissions instead so would trace that too.