I opened a ticket: https://buddypress.trac.wordpress.org/ticket/6335#ticket
Login (same as here) and subscribe, so you can follow dev’s opinion. Not sure they come to the forum quickly.
I’m not sure it is a BP issue. Could also be a plugin or a corrupted one who takes action when BP is enabled. Can even came from WP itself.
So i strongly recommend you close the site access. You will loose much more as some signups if that issue is viral.
Have you some server access log to share ? Or warnings coming up ? Activate debug in wp-config
You (we) have to wait for more opinions about this. Keep calm and stay confident.
