unknown people joined my server

So yesterday i was afk for a while i was walking my dog then my friend tells me on discord : "hey bro can i get the perms to launch the server there's 2 people that we don't know on the server" and i checked and there was 2 people, 1 with a cobblestone skin and the other one with a steve skin. I couldn't ban them or kick them from the game, they weren't whitelisted and the whitelist was on so how did they get in my server? I need answers cuz that's really creepy.