Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.
DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that domain or one of its subdomains will be directed to that organization's DNS servers, giving them full control over all subdomains. They can, of course, choose to delegate this control to someone else if they wish.
For example, if I were to register reirab.com, if someone queries subdomain.reirab.com (and no cache is involved,) what would happen is this:
Their DNS server would first ask the root servers for the first domain from the right, i.e. com. They would be returned a DNS NS record telling them the authoritative name server for com.
Their DNS server would then submit a request to the com authoritative name server that it discovered from the previous request for reirab.com. It would again get an NS record response telling it the authoritative nameserver for reirab.com.
Their DNS server would now submit a request to reirab.com's authoritative name server for subdomain.reirab.com. Since I would own reirab.com, I would have full control over this authoritative name server. It would either be a server that I myself own or one that is hosted by a third party on my behalf. The only subdomains that could possibly be returned (authoritatively) for this domain are the ones I myself have created records for on that authoritative name server. The only way for someone else to register a subdomain of reirab.com would then be for them to ask me to set it up for them, since I own the authoritative name server for reirab.com and all requests for its subdomains would be funneled through my server.
If I did want to delegate control of some subdomain to someone else, I would do it exactly the same way my registrar delegated control of reirab.com to me: with an NS record. By adding an NS record for subdomain.reirab.com to reirab.com's authoritative name server, I can authoritatively direct requests for subdomain.reirab.com and any of its subdomains to the name server listed in that NS record, which would be controlled by the organization to whom I delegated control of that subdomain. I could revoke this delegation at any time by removing or altering that NS record.
By the way, 'www' is not treated specially by DNS. It's just another host name in its domain's authoritative DNS server. It's only by convention that we put the host (A or AAAA) record for that organization's web server there. The A record for www.exampledomain.com and somethingelse.exampledomain.com both most likely lie on the same server: exampledomain.com's DNS server.
Note: This answer has intentionally simplified things a bit for the case of someone requesting a DNS record from the Internet. If a request for a domain comes from within the domain's organization, the request will likely be resolved directly by the organization's name servers without going up the chain to root-servers.net, the TLD's name servers, etc. In this case, a host name could potentially even resolve to something different than what it would resolve to from the Internet, if the organization so chooses.