users added without admin notification on itheme security activated site

I cannot believe this just happened; I used to secure all my sites with this product, only to find over a 100 bogus users on one of them and not one notification to the superadmins. Switching over to Sucuri.

https://wordpress.org/plugins/better-wp-security/