So far I haven't seen link-following behaviour yet.   Would it be possible for you to check your logs and verify the registration links are being followed, and from where?  You could look for the registrations URL and check the referer field to see where the traffic came from.   This would also verify that the /register link is returning a 404 as you expect.  It might be that another variant of the register URL is still working, and that is how the registrations are occurring.

 

@Bill - the bots following the login - could you try doing something similar and change the default login page URL and block them at that point?

@matthew - the registrations are obviously using some type of list of harvested email addresses, which is why they look like real users to the uninitiated. They also use generated usernames which look kind-of-real.

This is the script I used to soft-delete all the users that were spam registered:

update Users set IsDeleted = 1
where UserName = displayname and (LastIPAddress is null or LastIPAddress = '') and FirstName = '' and LastModifiedByUserId = -1
and CreatedOnDate > '2014-05-12'

The date was one in which I detected the spam registrations starting - this might be different for different sites. The definining signature of the spam registrations is the lack of activity after the registration. I would use a select statement with the same 'where' clause to see if it is picking up only the bot registrations and leaving your actual users alone.