"Replace in debugging" say someone is changing values of fields, tables or so by using the debugger.
This should normally not occur in production systems, but more likely in development or test systems.
However this is noted in the system log (Transaction SM21), so to monitor, have a look at the system log.
Hope this helps
Even if i am not a authorization expert, as of my knowledge the authority to replace in debugging is controlled by authorization object S_DEVELOP with ACTVT=02 (change) and OBJTYPE=DEBUG.
So you have to check what authorization you users have (or not may have), to restrict this.
I do not know of a general switch that can control it (like some settings in SCC4).