Registrations disabled but users keep subscribing

Wondering if anyone can help.

I have the General > Settings “Anyone Can Register” turned OFF.

However, the site is still receiving spam registered users. i.e. accounts are being created even though Membership is turned off.

I have the ClassiPress theme installed which creates a /register/ URL to mask the default WordPress one but registrations are disabled.

I have a Gravity Form which does user registration but it is set to manual approval and no entries are showing for those users who are appearing in wp_users.

I checked the site logs and one of the spam regos did post through the registration page. Here’s the HTTP requests (IP and Site URL redacted):

IP REDACTED – – [11/Nov/2014:13:32:54 +0000] “POST /register/ HTTP/1.1” 302 – “http://www.mysite.com/register/” “Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0”

IP REDACTED – – [11/Nov/2014:13:32:57 +0000] “GET / HTTP/1.1” 200 138849 “-” “Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0”

The request shows that the user registered through the /register/ page

We use WordFence as our software firewall and its scans come up with nothing as regards to malware.

They are not logging in as another user as I have an audit log showing me all activity. It’s definitely a WordPress registration.

If registrations are disabled, how can users still register with the site?

Thanks,
Wil.