Teachers are able to create user accounts during restore even they don't have "moodle/user:create"

Please read http://moodle.org/mod/forum/discuss.php?d=106252 and http://moodle.org/mod/forum/discuss.php?d=104358

FULL STEPS TO REPRODUCE
=========================
1. go to server A
2. backup a course together with user accounts
3. go to server B and log in as a Teacher or Course creator
4. restore the backup

WHAT WAS EXPECTED
===================
As neither Teacher nor Course creator have granted capability "moodle/user:create", no users are restored

WHAT ACTUALLY HAPPENS
=======================
New users are registered. The Admin does not know anything.