I've been getting a disproportionately high number of subscribers to my WordPress site relative to the little traffic it receives. I suspect most of these subscribers are bots. Normally I delete any that have a really weird Russian email addresses, but it is getting harder to tell if any of the subscribers are real people or not.
Nobody ever comments or changes profile images, so it just seems like it might be best to disable the comments and registration features.
In particular, I keep getting this one suspicious user who uses the username "Services-Resources." It sounds like a potential exploit for sending out fake emails under my website's name. Registered users only get contributor access, so I don't see what the hackers have to gain other than the satisfaction of annoying the webmaster.
I don't know if I am missing out on something that can do a better job of blocking spam. I currently have a recaptcha, WordFence, and some email scraper blocker plugins (I don't have Akismet anymore).