When writing a new post, if a user sets the post status to "Private" and then clicks publish the post actually goes into the blog as a "Published" post, not a private one.
The code causing this (I think) is the wp_publish_post function in wp-includes/posts.php, it containes the following line:
return wp_update_post(array('post_status' => 'publish', 'ID' => $post_id, 'no_filter' => true));
There are some if statements prior to this that check if the post is already published, perhaps a check could be put here to see if the post is private and a new line added as follows if this evaluates as true.
return wp_update_post(array('post_status' => 'private', 'ID' => $post_id, 'no_filter' => true));
This patch is untried!'''