So the cause: mcmmo handles bonus damage in a funny way now. It cancels the initial damage, then pretends (.0001 seconds later) that you hit the target with a different damage value. This would be fine, but that means your arm isn't where it should be when the damage is dealt. Cue: NoCheatPlus. Your arm isn't in the 'hit' position? You're a hacker. Stop the damage.
So I tweaked the NoCheatPlus configuration to be a little bit more lenient. It will still catch and cancel you if you spam attacks or get a hack client, but 90% of your bonus damages should now land accurately and with the correct value.