We look after a bunch of WordPress sites none of which run themes which involve public participation. So basically the setting Membership - anyone can register is always turned off.
I have just taken a look at one particular site and found a few dozen mystery subscribers in the user list. Checking the settings I find this site is has anyone can register turned on.
Easy enough to delete them and fix the setting.
A couple of questions however:
1) Should I check anything else apart from deleting the new users and fixing the setting?
2) What do these (presumably spam) subscribers get out of the deal? They get no access to the site, as I understand it, and no eyeballs on any spam they might want to push.
Incidentally, this site is running an up-to-date version of WordPress.