Invisible player on my server?

I would try to remove everyone from the whitelist, and see if they still connect. If they do, you have a huge problem.
If they do not, add back the people 1 by 1. When the griefing starts again, it is the person you just added.
Can you post the server config file?
Also, you probably already did this, but open the whitelist and make sure they are not there.

I'm suggesting banning and deopping the random name and numbers. Better still, don't deop - delete your ops file.

One other thing. Are you using Bukkit, or are using the server from minecraft.net?

Here is a list of my plugins:
advlog
autosaveworld
banhammer
chestshop
choptree2
commandsEX
firstjoinplus
glowstone lanterns
group manager
homespawn plus
magic torches
lockette
modreq
monsterbox
multiworld
olychatsuite
permissionsbukkit
pickuparrows
pluginmetrics
worldedit
zavautomessager

any you recognize that might be bad?

Any of them could be bad, any one of them could be a malicious version. I'd wipe each one off, then re-add them one at a time, making you download them from bukkit.org. Also, it might not be a plugin, as Soul said, you might be having much bigger problems.

I got them all from bukkit.org or dev.bukkit.org. and it took forever to configure them... so id rather not erase them all. and no1 is op that i dont know (i checked the list) so some1 isnt using a plugin or something to gain op...

Last Resort time: Wipe the sucker.

There is only one answer to this... Contact notch

Can you post the file named server.properties?
This would help me diagnose whitelist issues.

Look at the console and get the IP he/she joined from and ban it.

Do you have /vanish command?

You can also just remove all whitelisted people =P

They did not show up as an online player.

Nope.

The only whitelisted people are people i know in real life and i see 5 days a week at school .

Mabey it's one of youre friends?????

sure, but ill block out the ip.

#Minecraft server properties
#Sun Sep 09 17:37:21 MDT 2012
allow-nether=true
level-name=RepubliCraftnew
enable-query=false
allow-flight=true
server-port=25565
level-type=DEFAULT
enable-rcon=false
level-seed=
server-ip=*REMOVED*
max-build-height=256
spawn-npcs=true
white-list=true
spawn-animals=true
snooper-enabled=true
hardcore=false
texture-pack=
online-mode=false
pvp=true
difficulty=1
gamemode=0
max-players=200
spawn-monsters=false
view-distance=10
generate-structures=true
motd=RepubliCraft Beta!

there it is

I think the problem is the line that says:

This means that your server does not check to make sure everyone is a valid player.
Change it to true.

To quote the minecraft wiki:

My friends who play do not have minecraft accounts i gave them all hacked clients so they can download the jars. I have that set like that or else none of my friends can get on . I have it white-listed so only my friends can get on, and they tell me the usernames they use.

Highly unlikely. Impossible actually. Well, if he's running it off his router, I suppose he could make his IP dynamic long enough so that it changes, then make it static again...

I am 99% sure the griefers are getting in because of the online-mode setting. Even if there is a whitelist, anyone can get around it if it is in offline mode.
Any reason your friends don't buy minecraft accounts?

I'm no server genius and never used bukkit but the fact your friends use HACKED clients that have HACKS in them and qwerty's post explains all that.

I'm seeing a pattern here.

I wouldn't help you even if I knew the solution to the problem. Minecraft is only $27, there's no excuse to use it illegally.