If your router is running WPS (most of them are by default if you haven't disabled it), then the WPS code is all-numeric and isn't necessarily changed when you change the passcode. They may be connected via WPS connections and
I'd do the following, if it's not an issue with updating other devices that use WiFi:
1) Change the network name to something else that isn't what you have currently.
2) Hide the SSID so it's not visible to anyone. You should be doing this by default to not advertise your network name.
3) Change the password to something completely different and use lower case characters, upper case characters, numbers and special characters. Make it something a bit larger than two words plus a number or tow.
4) Block the MAC addresses of the consoles at the router. They can't change the MAC addresses on the console, so blocking them by MAC address will stop them from doing anything.