Okay, this for some reason is a issue that is happening for some people out there, it happened to me too so I'm here explaining how to fix this issue:
What happens?
If you allow players to join via IP + Port without joining your BungeeCord server, and your server is in offline mode, people can create a local BungeeCord and spoof his UUID and IP, allowing players to join with a spoofed UUID (example: join with your admin's UUID) and gain everything that account has.
Example: You have...
UUID spoofing under bad configured BungeeCord
What happens?
If you allow players to join via IP + Port without joining your BungeeCord server, and your server is in offline mode, people can create a local BungeeCord and spoof his UUID and IP, allowing players to join with a spoofed UUID (example: join with your admin's UUID) and gain everything that account has.
Example: You have...
UUID spoofing under bad configured BungeeCord