I have noticed identical symptoms.
I was able to work out how it was happening.
In wackwall i have a site and have what seems a secure (ish) chat session.
http://www.shuttertime.wackwall.com
There was a post in the wackwall forums about being able to moderate the tinychat externally. Which it seems can be done.
Part of the method for moderating the chat was to check your chatroom name.
To do this you goto the chat page in your site and read the page source. A bit down that you see the name. Mine was "shuttertime"
Now I am hosting my own site using wackwall I noticed people in the chat room minutes after I installed the site. I checked page source for the room name and it was "www".
No I believe what is happening (but not sure) is that in WACKWALL the tinychat is looking at your URL
www.shuttertime.wackwall.com, seeing shuttertime as like a subdomain and using that as the chatroom name. Because my site is now
www.shuttertime.co.uk, it is dropping the shuttertime and maybe thinking the www is the subdomain thus setting the roomname to "www".
The reason I say this is I chatted with one of the people, they pointed me to their site which was
www.edwardandbellafanclub.com but it, I think was hosted on wackwall. So It seems if you install oxwall on your own site or you use your own URL for wackwall, tinychat room names get a little mixed up.
I did try to have a look at the code but not knowing where the roomname is set it is difficult to be sure what is happening.
@ John, bear in mind, tinychat is a 3rd party plugin. Also I do think users CAN join your chatroom (when fixed) externally through
www.tinychat.com/yourroomname but not from the chat on your site.
You could find another chat program and create a page for that and disable tinychat. I am going to try phpfreechat and see if that works. OK I lose video and broadcast which blows a little bit. Yeah I would prefer to see the tinychat api working with a few more options securing it to the site.
I posted a similar issue a wee while back.
http://www.oxwall.org/forum/topic/19
Due to it being 3rd party, I am not expecting swift responses...