NTLM vs Kerberos authentication - questions
how can this be that while "Write ServicePrincipalName" privilege is turned off for the SQL service account, domain users are connecting using Kerberos auth


That privilege is not required for Kerberos to work, it only enables the service account to register its own Service Principal Names (SPNs).  

See Register a Service Principal Name for Kerberos Connections