Subuser can create subusers even though permission is not set

I only allow certain roles to create subusers.

So I logged in as one such user, and created a subuser, which is an ordinary user. I switched to that subuser. I saw, in the personal profile, the option to create a subuser... I assumed that subuser would have been created under the original parent, but no. It gets created under the first subuser. The original parent cannot know that the first subuser created a subuser.

Even when logged out, and logging in as the first subuser, not via the parent, I can still create subusers. I have no idea if it is because I have already created a subuser , or if the permissions are just screwed up.