I was surprised by the fact that it's not in the address table of the switch itself. It turns out that the "offending" MAC address is the MAC of the physical gi0/1 that connects the 3560x to the 2960.