I've seen this issue when endpoints are plugged in to dumb switches, KVMs , and non Cisco IP phones (mab endpoints connected through an third party IP phone, and dot1x endpoints when the IP phone doesn't support eap proxy logoff). Normally, when a wired endpoint moves from switch to switch, the port status would go down/down, and the authentication session would be cleared. When there is not a direct connection from the switch to the endpoint moving, the port state does not change, the switch will think the endpoint is still connected.
The mac move permit only applies if the endpoint is plugging in to a different port on the same switch/logical switch stack, and not if the endpoint moves to a different switch.
Some ways to address this way include ensuring that endpoints are not passing through unmanaged switches/KVMs and have a direct connection to the Cisco switch performing the 802.1x/mab authentication. The second method addressing this for sessions behind third party IP phones is to enable the radius idle-timeout as part of the authorization result.
