Players are able to fly when they first join

Not sure how this has happened, but players seems to be able to fly as soon as they join the server.

 

check all your settings - server.properties is fly on or off (though it needs to be on if you want to allow it for some)
Is the server creative mode
Are you using world managers, and the world settings have creative mode
Are you using a permission system and plugin to activate flying; has that permission node been added to the default rank by someone? (There are exploits out in the wild that can make high-ranked users execute commands without knowing, not all commands are op-me types, some folks go for more subtle things like this)
Are the players using a command to fly, or are they just able to use creative fly on vanilla clients, or is it like always - hacked clients finding ways to fly.

You need to identify the mechanism of flying and extent of 'people can' -- is it just bad people, or is it every test account you try , are clients not a factor, etc.

 

I had eventually found the problem, The plugin latest AuthMe version doesn't have the fix for when people would spawn in, they would be elevated in the air to be able to fly. So I had to revert back to 1.7 builds for the problem to be fixed.