When I received this Drupal 7 site to manage, it has had years of being open for people to make accounts and now I have ~ 300 PAGES of users with names like ismehacker1234568 and such, with under a dozen legitimate accounts I need to keep.

Once, on another site long ago I tried removing the users from the database table using a SQL query. That was a disaster and broke the entire site. I want to avoid that this time around.

I also need to delete any content they made, but not anything the legitimate users made.