I made a tool for this some time ago. It detects when programs write to your home directory outside the XDG spec and logs the file and the location of the binary that wrote it to an SQLite file.