There's an issue with the MyBB software where someone is able to see the online locations via the profile system when the Who's Online system is disabled.
If you're referring to the "Show Who's Online?" setting it doesn't disable Who's Online, only prevents it from showing on the forum index. If you view online.php you can see who's online too.