Managing Members in Marketing List

Hello,

I recently learned that our users are able to manage members of lists in which they are not the owner despite the security settings we have in place. Users are not able to add a new contact on the main page. However, when users view the contacts using the sub-grid, the Manage Members button is available to them, and they are able to add and save new contact to a list. How do I go about preventing users from adding contacts this way if they do not have the permission to do so?