I’m the developer of BuddyPress Security Check. Unfortunately, it appears that spammers have found a way to complete the math sum, allowing them to register. This means that BuddyPress Security Check will probably not prevent bots from registering. It certainly isn’t generating fake signups though. Probably best to disable BuddyPress Security Check until I figure out how I can fix it and release a new update.