Just deleted over 800 users from my database that joined in the last few hours from obviously fake emails and botted usernames. Make sure to either close registration or have some sort of safety check in place because things are getting hairy out here.
Luckily caught it relatively early and only had to remove 120 fake users. The registrations stopped immediately after I turned on "require registration application".
this happened overnight for me. I turned on captcha and email verification. captcha is important. I was watching the logs and all activity stopped after captcha got enabled.