BuddyPress.org

I’m surprised to hear that the members are still able to log in, even if they don’t click on their activation link. That shouldn’t be the case.

In any case, you might start your search for the activation key message in bp-core/bp-core-signup.php. The function bp_core_signup_user() creates the activation key and hands it off to bp_core_signup_send_validation_email(), which creates the email. The content of that email message is filtered, so that you should be able to change the message without hacking the core files.