Candidates Applying to jobs posted on Private Career Site

Summary

Private career site postings are being accessed through job boards

Content

In our career site configuration, we have a site configured as Private which is used to invite candidates to apply to specific jobs.  This site should only be accessed through a link embedded in a correspondence sent to a candidate.  Recently, we had 1 candidate apply through Ziprecruiter and another candidate apply through Monster.  At the time these candidates applied, the job was only posted to a 2nd pass site (also Private) and the Invitation career site. 

Have other companies experienced this issue?  Any suggestions on how to avoid this from occurring?