Thank you for proactively contacting me regarding this @[email protected]. I've had this issue on my https://feddi.no instance, but I have added a captcha and registration applications now. Hopefully it will alleviate some of the problem.

All of the bots accounts seems to have a number in their email so I manually looked through the list of users in email_verification that contained numbers in the email to look for false positives:

select * from email_verification where email ~ '[0-9]+';

before running

delete from local_user where id in (select local_user_id from email_verification);

to delete the users.

By suggestion from @[email protected] I updated site_aggregates to reflect the new users count on the instance:

UPDATE site_aggregates SET users = (SELECT count(*) FROM local_user) WHERE site_id = 1;.