I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only.
In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. This has been tested and they can't be accessed, neither can '/user/register'.
I have found that some randomly-generated-looking username/email address combinations have appeared on the site. They're created in a blocked state due to the new accounts setting of requiring Administrator approval for a new account. All of their 'last accessed' fields are 'never'.
My question is how the accounts could have been created from an external connection without accessing the URL '/user/register', or any of the other blocked URLs?