I assume you're using a Linux based system. For ssh, the behaviour you see is perfectly normal. The access restrictions a user has are imposed by the rwx fields on your system.
There is no possibility to lock ssh users to their home dir. It you want to lock them, you'd have to use something like ftp, which offers you directory limitations. That's the reason for me (and a lot of other ISP's) to shutdown ssh services for regular users.