Isopropyl Exploit - Anyone can join any server as any name!

I noticed on my server, and on a few of my friends servers (vanilla, bukkit, spigot, etc), that there are hackers who can join as any username. I've tried banning them, they keep coming back. There is usually one called Isopropyl, and they call it the Isopropyl Exploit. There are no unusual logs in my server, or my friends.