I had a few problems with presumably hacked clients which could be kicked or banned. The message about the kick or ban appears, but the client is still online. There is also no disconnect message at the server log. IP ban seems to work though.
After the client disconnects once he is unable to reconnect and gets denied with a reason as expected.

Actually I am not familiar with the Minecraft protocol, you might know better, but what happens if the server sends the disconnect (request?) to the client and the client just ignores this?

I was also thinking about how to solve this outside of Bukkit by crawling the logs for ban events without following disconnect notice and the use a tool like iptables or tcpkill to forcefully close the connection.

I've had issues before with banned players who weren't properly disconnected by the server. This only happened very rarely, and when it did, I could kick the player again and he would be gone.

I could never reproduce this, though. Are you sure that only the IP ban works in your case?

Unfortunately could not reproduce due to lack of cheaters yet ^^

Found something:
I added a few comments inside the following logs at the lines ends.

[20:34:33 INFO]: aTeamMate hat so eben EvilCheater wegen Tpa-Spam verwarnt. #has been warned for reaon
[20:34:33 INFO]: EvilCheater wurde von Console wegen zu vieler Verwarnungen für 2 Stunden  ausgeschlossen. #automatic ban for 2 hours for having too many warnings
[...]
[20:34:45 INFO]: EvilCheater issued server command: /tpa aTeamMate #still there, no disconnect.

Just cropped out stuff from other players.
A few minutes later

[20:36:42 INFO]: aTeamMate issued server command: /ban EvilCheater Hack
[20:36:47 ERROR]: Permission name cannot be null
[20:36:48 ERROR]: Permission name cannot be null

The Ban command was not successful.
The PEX issue has already been discussed here as well as at the PermissionEx repository which with the result that this may be either Spigots or Essentials fault.

[20:36:52 INFO]: aTeamMate issued server command: /unban EvilCheater
[20:36:52 INFO]: EvilCheater darf den Server dank aTeamMate wieder betreten. #Unban command was successful due to the tempban that has been executed by console earlier
[...]
[20:36:53 INFO]: aTeamMate issued server command: /ban EvilCheater Hack
[20:36:53 INFO]: EvilCheater wurde von aTeamMate wegen Hack dauerhaft ausgeschlossen. #ban command was successful, but EvilCheater is still here.

A few moments later:

[20:37:21 INFO]: aTeamMate issued server command: /banip EvilCheater hack
[20:37:21 INFO]: 88.208.xx.xx wurde von aTeamMate wegen hack für [expires] ausgeschlossen. #the command was executed successful
[20:37:21 INFO]: EvilCheater lost connection: Du wurdest wegen hack dauerhaft ausgeschlossen. #SUCCESS. Disconnect message!
[20:37:21 INFO]: Bis später, EvilCheater. #"See you later, EvilCheater", default player leave message.

Also found another small issue. [player] was not replaced correctly:

[20:37:54 INFO]: Warning: [player] attempted to join the server but was denied due to hack #as visible in next line [player] should have been EvilCheater
[20:37:54 INFO]: Disconnecting com.mojang.authlib.GameProfile@4115ef65[id=e9bfd01e-6aee-4b64-b988-5xxxxxxxxxxx,name=EvilCheater,properties={textures=[com.mojang.authlib.prope
rties.Property@4ccaf8d6]},legacy=false] (/88.208.xx.xx:63602): Du wurdest wegen hack dauerhaft ausgeschlossen.
[20:37:54 INFO]: com.mojang.authlib.GameProfile@4115ef65[id=e9bfd01e-6aee-4b64-b988-5xxxxxxxxxxxx,name=EvilCheater,properties={textures=[com.mojang.authlib.properties.Property
@4ccaf8d6]},legacy=false] (/88.208.xx.xx:63602) lost connection: Du wurdest wegen hack dauerhaft ausgeschlossen.

BM is just using the in-built Bukkit kick method.

https://github.com/BanManagement/BanManager/blob/master/src/main/java/me/confuser/banmanager/commands/BanCommand.java#L158-L174

If you're able to reproduce this, is it possible for you to try running any BM punishment command as EvilCheater? If so, I'll take a guess that you'll get an actor_id can't be null exception in your console.

@confuser I am not sure if this issue report at Spigot is related to this issue, because the clients here were able to interact with the world, use commands, could get teleported etc. They were just not disconnected properly.
The Spigot issue report complains about players they were just non-active ghosts; the client WAS indeed offline.

EvilOlaf are you sure that after the ban didn't disconnect the player a kick was not sufficient?

Regardless, the commit that closed this issue should suffice in terms of a fix.

@Kakifrucht Yes, I am pretty sure about that.

https://hub.spigotmc.org/jira/browse/SPIGOT-796