users can access a lot of sites with out any authentication anyone can explain than and solve this issue

users used sophos ip address with port 3128 as proxy and enter its credentials in Captive Portal Link https://:8090 for authentication and access the internet 

but some unauthorized user can access internet by used sophos ip as proxy with 8090  port in proxy setting instead of 3128 this allow them to access internet without any authntication