I have created a two-step approvals team which has two users, John (Submitter) and Jim(Approver).
Jim is able to create and submit emails for approval to this team and approve himself.
How can this be prevented?
This is as designed. You can make it mandatory on in your operations manual that the approver has to submit to a group that he isnt a part of, but there is no way to enforce this strictly through approvals.