have a read of your router manual again
there are 2 setting for MAC filtering
1) you allow EVERYBODY EXCEPT the MAC addresses in the list of MAC addresses (i.e if they ARE on that list they dont get access , but everybody else does
2) you ONLY allow those with the MAC addresses in the list (ie - if they aint on that list they dont get access)
it SHOULD be set to 2) - the precise wording of this option is in the router manual
SOME routers also have the option of acting as a wifi hotspot - THIS is not controlled by MAC filtering and allows anybody to use your router via a link separate from your LAN and protects your security. AND can only use "dead" time to connect to the internet ("dead time" = time when nobody on you LAN is connecting to the internet.
(If they are connecting to the internet but not connecting via WIFI hotspot then they must be connected to your LAN and know your WIFI security code )
you want to stop anybody youu dont want connecting via your router - then set MAC filtering to 2), remove all MAC codes you dont want access from the MAC setting page and turn off the open WIFI hotspot connection (this should be on a different page and nothing to do with your LAN WIFI
It sounds like the other people have nothing directly to do with the guy you are taking about, unless you got your MAC filtering set wrong . If its set correctly then he CANT pass on his connection - cos THEY will have a different MAC number and MAC filtering wont allow them to connect - even if they know the WIFI security code (you have set a security code I hope?)
All HE might have done is pass on the fact that you have a router acting as a hotspot .but all you gotta do is turn it off
(note
from what I can see the note 9 can be a wifi client - but cant be a wifi server (which it would need to be to allow others to connect via its connection to you)