I have anyone who registers on my site set to be a subscriber. And I just realized that someone who recently registered, and is shown to be a subscriber, was able to create posts!!! They were still in the pending stage waiting to be approved so they were never published. But how the heck were they able to do that? I'm worried now.