buddypress profiles being created without admin notification

Hello all,

This probably sounds like a newbie question, but this is worrying me to no avail. When myself, friends, or family create a profile to test the site, I always get an email as the administrator.

But over the past few weeks, I'm getting individuals creating buddypress profiles and upon further research into my database, I track their email addresses back to health supplements, pharma drugs, and/or porn sites. I don't receive an email notification when these buddypress profiles are made.

Currently my settings are as follows for site admin, where the second choice with the "X" is selected.

Disabled
X Enabled. Blogs and user accounts can be created.
Only user account can be created.
Only logged in users can create new blogs.

Wondering how can they create buddypress profiles, without me getting notifications?

Thanks.