BuddyPress.org

Either they;re getting in via the bbpress signup, or they are using exisitng logins.

Have you got “allow users to add exisiting users” checked in the super Admin -> Options menu? If so, UNcheck it. that’s one way we know they were getting in.

Also – you did nothing to the default multsite signup page, whcih is yoursite.com/wp-signup.php. Change that to a .txt file, then NOBODY can sign up for a blog on the front end.