I've noticed even if I unpublish an album I am still able to get to it if I manually type the album link in. Is this a 'feature' and is it possible to turn it off? I figured if I unpublish an album it should be hidden regardless of how I try to access it...

That is by design. If you wish to make an album unaccessable use password protection.