Yesterday i logged in a site that i do not log in often and found about a hundred spam registrations – obvious “spammy” user names and bogus email addresses. Had to delete them manually and install SafeGate plugin to prevent such thing from happening.
If you have similar issues with lots of illicit registrations on your WordPress site – try my free SafeGate plugin – download here: https://fnlpulse.com/safeuser/