Ok, there was an old ticket filed against Openfire and Client Control plugin related to user still able to edit profile even if it was disabled in Client Control plugin. But after taking another look on this i think it is purely Spark bug and i have filed it as SPARK-1516.
But i wasn’t able to reproduce nickname change in a MUC room if nickname changes are disabled. At least with the current 3.8.1 nightly build. Can you provide exact steps how you achieve that?