I had 5 "spam" users register on my blog.
Both these options were on/checked:
Anyone can register
Users must be registered and logged in to comment
I just turned off/unchecked anyone can register when I read them.
New user registration on your blog <blog name>:
Username: yhgtfrty
E-mail: yhgtfrty@gmail.com
---
New user registration on your blog <blog name>:
Username: iuytrtyui
E-mail: iuytrtyui@gmail.com
---
New user registration on your blog <blog name>:
Username: kujyhtgrt
E-mail: kujyhtgrt@gmail.com
---
New user registration on your blog <blog name>:
Username: jhgfdfghe
E-mail: jhgfdfghe@gmail.com
---
New user registration on your blog <blog name>:
Username: wertgfdd
E-mail: wertgfdd@gmail.com
those are the 5 e-mails. I know in phpbb (forum software) I can make it so users who register have to activate their accounts by clicking a link on an e-mail they received.