People adding their own multisites onto my network

My website is imhereworld.com.
I am using multisites.
For some reason, someone’s been flooding my domain and creating multisites with a bot. I have literally hundreds of multisites that I’ve never created.

I don’t know how someone’s able to do that without having a user account and password for my site.

Is there a setting that I need to check to stop this from happening?

Thanks.