Those two settings are 100% the ones controlling the behavior, so it sounds like their settings were changed after the fact or there's something else going on.

The problem is that you don't actually want to prevent them from uploading a PDF otherwise they wouldn't be able to convert them; what you really want is to not store them as PDF, which is quite difficult to enforce.

There's not really a way to outright block users from storing things in a specific format, especially since anything you add/upload has to get to the repository before it can even be converted to native pages (i.e., even if you could block PDFs, you can't convert them if they can't get into the repository).

You could set up workflows with rules to look for new entries with an electronic document component so you could detect this and either send a notification or run some additional processes, but realistically this is one of those procedure or training issues that's hard to address programmatically because there are so many holes you'd have to try and plug.

A phrase we commonly use among our dev team is "you can't program accountability" which basically means that sometimes an excessive amount of work is required to only partially mitigate issues that are more easily avoided if people just followed an established process/procedure.

You can take other measures, like setting default attributes in the Everyone group so all new users start with the desired settings, but at the end of the day no matter what you put in place people will find a way to cause issues because you can't really stop them without revoking necessary permissions.