I know the broad strokes of how people were getting free calls and so forth, but obviously the phone company found out and started fighting it. How did Ma Bell do so?
Contemporary sources such as “Beating the blue-box bandits” in IEEE Spectrum or this article in the ham radio magazine 73 were circumspect about the security measures being undertaken, and no retrospective research seems to have looked at the initial discovery. Because some blue-box users also played fast and loose with other laws, it seems likely that the first blue box discovery came during an unrelated police raid. Since the device would have somewhat resembled one of the new Touch-Tone phone dialing pads, investigators would naturally have turned to someone in the telephony community to figure out what it was. The term blue box was already being used in this 1963 Police Yearbook article. A June 1977 High Times story about “Captain Crunch” mentions tinkerers who built blue boxes for the Mafia, and also says the Captain was turned in by FBI informers, though it doesn’t say what prompted their actions.
It’s also possible that computer analysis turned up billing records for calls to toll-free numbers at unlikely times of day, or for unlikely lengths of time. In an era when long-distance was fairly expensive, one common use was long-distance romance. Nightly 45-minute phone calls to Avis would raise questions if spotted—especially if coming from an MIT dorm. This 1973 newspaper article describes such analysis.
Once the (fairly simple) technique was known to Bell System security, it was easy to defend against using notch filters or more sophisticated equipment.