Some network cards can change, but one time only. Again, saw it
somewhere online, but I lost that list. It's only a few years ago
that this is allowed.
The list of hardware addresses are to prevent fake stocks though...
not to determine if it is spoofed or not. In a way, it does help to
detect spoofed addresses, but that's not its main aim.
Pattern of traffic is usually not that important, unless somebody
tries hacking. It can be done, it is taught in school (at least in
RP). 
You can easily check this through command prompt in
Windows...
Exact syntax is arp -a
If somebody tries something, you should be able to see.
netbios and netstat too...