Directories being shared without being on the file sharing list
The simple act of clicking the "File Sharing" check box will allow the following things to happen.


Any user account can connect to the machine and access their own home folder, as well as the public folders on any other user account.
Any administrator users can access the boot disk.


The list of shared folders in the preference pane is for fine-tuning access to public folders and defining customized share points.

You can fine-tune the basic share points with Mac OS X Lion Server, which is available as a software package from the App Store nowadays. It's not terribly practical to try to hack this yourself on the command line. While it may be possible to just mess with the server daemon's configuration files, it may be more trouble than its worth when you could just disable the built-in server and install Netatalk.

Really, the easiest option if you just want to open up parts of your computer to specific logins, would be to create "sharing only" user accounts, allow them access to specific share points that you manually define in System Preferences, and disallow them access to the public folders.