Turns out the unwelcome new users all came from some old "friends" of ours, Beyond The Network America.

These particular spammers have been hitting Geeklog sites for several months now. Their bot registers a new user, parses the registration email that is being sent out and logs back into the site with that information a minute later, then immediately starts spamming.

However, none of those new users managed to log in - probably because the email sent out from the site in question is in German.

For the record, here are the IP address ranges owned by Beyond The Network America. We have seen these bots coming from all of those address ranges, so we'd suggest to block them:

205.252.*
206.161.*
209.8.*
209.9.*

In the instance here, the bots came from 7 different IP addresses within the 209.8.* range. Now I only have to find out why my .htaccess rule to block them does not seem to work on that particular site ...