Running with online-mode=false lets players join without a Mojang account. It also removes the only thing that proves a username belongs to the person typing it, and that has consequences you have to handle yourself.
Why it happens
With authentication off, the username is whatever the client claims it is. Anyone who knows your admin's name can connect as that name and inherit their permissions. Nothing in the server stops it, because there is nothing left to check against.
What to do
- Install an authentication plugin before opening the server
AuthMe Reloaded or an equivalent. Configure it before the first player joins, not after the first incident.
- Require registration and login
Until a player has authenticated, they should not be able to move, chat or run commands. That is what stops name spoofing from turning into an operator account.
- Never grant permissions by username alone
On an offline-mode server a username is a claim, not an identity. Tie operator rights to accounts that have authenticated through your plugin.
Offline mode is your choice to make, and the risk comes with it. We are not responsible for griefed worlds, spoofed admin accounts or command abuse on servers running with authentication disabled.