A very obnoxious player on my server keeps pointing out when mods are online because he has added to his friends list (apparently you can just add anyone?) This lets him see when vanished players are online on the server. Not sure if this is fixable at all.

That's a problem with MineChat, isn't it?

Yes, But if it exposes a way to do it, its an issue.

The solution would be to provide an alternate IP address for your staff to connect on, so MineChat thinks its another server. If it's something that can be made visible to friends, it better also be locked down via plugin, and not using the same domain in hostname.