I tested this and it looks like there's something going on for sure. I also passed my findings along to the developers to look at.
So, just to make sure we're seeing the same thing:
- I created a shared calendar.
- I set myself up with full control
- I shared the calendar with someone and gave them read-only access
- I created an event and invited that person
- They accepted the event.
- They were able to delete the event, though. They couldn't change the recurrence or the date/time. Well, they could change the date and time but they couldn't save those changes.
Is this the same behavior you're seeing? Are your read-only users able to actually modify the event itself or can they only delete the event? Also, is this on the shared calendar or are the events showing on the users' default calendars as well, and are they able to edit the event on the default calendar?