There is a limit of 500 MAC Lockdowns that you can safely code per switch. To truly lock down a MAC address it would be necessary to use the MAC Lockdown command for every MAC Address and VLAN ID on every switch. In reality, few network administrators go to this length, but just because you have locked the MAC address and VID for a single switch, the device (or a hacker spoofing the device MAC address) may still be able to use another switch that is not locked.