Support ticket response from an administrator:

Hello,

It seems you have online-mode set to false. This basically increases the chances of your server getting hacked since most hackers will have a cracked client. There is nothing that can be done in this case since this is an exploit of Minecraft itself and has nothing to do with what you did or what we can do. The best defense is to enable online-mode and that only reduces the chances of hackers joining - some hackers will go through the trouble of actually buying multiple copies of the game just to mess with servers. There is nothing else you can do except IP ban those users by finding their IP in the server.log file (if it is too big, you will have to delete it and restart your server and wait for them to join again) then adding their IP to the banned-ips.txt file in your server's main directory.