Google recently modified how calendar permissions work for resources (e.g., rooms). Now, anyone who has permission to see if a room is free or busy can also schedule events in that room. We recommend reviewing the calendar permissions for the resources you own. Make sure to only give free/busy access to individuals or groups who should be able to reserve the room. This is done by unchecking the Share this calendar with others box and adding individuals or groups under Share with specific people.