The issue is probably related to the change from Winstone to Jetty8, in Jenkins v1.535:
I have reproduced the issue locally after a load test (the sessions chart shows a high number of sessions, but there are only one session in the list of sessions).
In the report http://localhost/monitoring?part=heaphisto or in a heap dump, I can also see that there is exactly the same high number of instances of org.eclipse.jetty.server.session.HashedSession existing in memory, as in the chart.
The cause can be related to the following jetty bug (fixed in Jetty 9.1, which is later than Jetty 8 used by Jenkins):
So the invalidated http sessions are not garbage collected, there is a small memory leak in the monitoring plugin, and the sessions chart is "not right".
I will fix that, with a workaround for the jetty bug.