You didn't say if this is an analog, digital, or IP station.
If it's analog, it can be tapped anywhere along the wire from the set all the way back to the PBX. Inspect your distribution frames. Also, if they are really that suspect, change all of the pairs from the PBX all the way to the jack, but that will leave you with a jack with non-standard wiring.
If it's digital or IP, it's HIGHLY unlikely that it's tapped. Certainly, you could have bridged appearances, but you could find those with the list bridged <primary extension> command. Plus, the individual concerned would have a CONFERENCE indicator on the set's display.
There is one type of tap made for digital stations. It IS used for recording calls. That is a Call Logger or Call Recorder used to provide quality assurance or compliance recording. One brand is NICE. Another is Witness. There are probably others out there that have the same hardware tap capability. I would assume you would know if you have this.
Another possible way to monitor a user's conversation is with Service Observing. You could check to see if the FAC is administered or if any stations have Service Observe buttons. Even this can be prevented by placing the user in a COR that no other COR has permission to monitor.
After these, you get into the more obscure reasons for the clicking. There is the possibility that you have a T1 slipping. This will cause popping sounds as it keeps trying to resynchronize. There is also the possibility of the handset cord. It could be wearing out, or the user could have one of those swivels that is used to keep the cord from twisting up. When they wear out from all the turning, they start to cause static and eventually prevent the station from being useable. It could even be interference from PC monitors, florescent desk lights, or other sources of electrical induction.
My first choice would be to change out the entire desk setup: the set, the handset, the handset cord, and the wall cord. First, it rules out defective hardware. Second, it makes a very visible change to the user. Also, if there is no business need to monitor this person, give the an Exclusion button or set the station for Auto Exclusion. The will prevent anyone from monitoring from within the system. It will also prevent Music on Hold from working.
Sorry about the long-winded answer, but a problem perceived by a user is a real problem to that user. They will not go away until they perceive that it is gone.
Good luck!
Bernie