How can I prevent uploading bmp image?

The magic is in get_allowed_mime_types() which calls the upload_mimes filter. That is filtering a default array consisting of keys as a non-terminated regular expression of file-extensions and the mapped mime-type as values:

array(
    'jpg|jpeg|jpe' => 'image/jpeg',
    'gif' => 'image/gif',
    'png' => 'image/png',
    'bmp' => 'image/bmp',
    'tif|tiff' => 'image/tiff',
    'ico' => 'image/x-icon',
    ....
}

so hooking into that filter and removing bmp should do the job for the moment:

/** prevent uploading of .bmp files. */
add_filter('upload_mimes', function(array $mimes)
    { 
        unset($mimes['bmp']);
        return $mimes;
    })
    ;

Just copy that over into a file named no-bmp-upload.php and place it into the wp-content\mu-plugins folder.