If you grant users the right to connect in a database, they can create a table under the default schema, the public schema.
It was weird when I first heard about it. They will probably limit it in the future. This is still the case in version 10.0.
You must revoke the permission granted to the public scheme as follows.
1 | REVOKE connect ON DATABASE databasename FROM PUBLIC; |