Check your wireless interface for "default-authentication=no"
if YES enybody can connect to your network!
In "/interface wireless access-list" you can add MAC addresses of divices who you wont to connect to your network!
/interface wireless access-list add mac-address=xx:xx:xx:xx:xx:xx interface="ap interface" comment="Known User"