BuddyPress.org

There was a recent change (Changeset 1295) to bp-blogs.php that stopped spam comments from being recorded in activity streams.

As Burt points out, newer versions of BP no longer have individual user activity tables, but I suppose this bug combined with an older version of BP could expose you to significant spam problems. I cannot verify this without looking at the older code. It is just a hunch.

I would recommend taking your site offline (if in production) and then upgrading your installation following the instructions found here: https://buddypress.org/forums/topic.php?id=1994