Having the identical issue as above. Spammer registers for site, activates and then I find them in a private group. No request to join, no approval by Group Admin. The only clue I have is that when looking at their profile it says they belong to the private group but the button to the right still says “request permission”. Somehow bypassing the approval process.