There is a bug in mod_bigbluebuttonbn 2.2.10 (2017101018)
Big Blue Button -activity automatically gives moderator rights to student role participants on a course if you have added moderator rights to a specific user that has same Moodle ID number as the student role in general has in the system context.
Default system student role ID=5 so if you give moderator rights in a BBB-activity to a user that has Moodle profile ID=5 students on that course will also get moderator rights.
It's like BBB doesn't notice the difference between user ID and role ID.
Steps to repeat:
1. Create a Big Blue Button activity on a course.
2. Check the Participants settings: "All users enrolled as Viewer".
3. In the Participants settings give moderator right to a user who has user-id five (5): Add participant -> User -> Name of the user.
4. Go into a Big Blue Button session as a student
5. The student gets the record notification when joining the session and gets all the moderator rights in the session.