Hacking with registering new users?

Hi everyone
I think I got attacked by some hacking because back couple of weeks I receive almost hundreds of new registered users in my website https://www.mondelio.org.

I found very strange that during a wend so many people have registered with the same email domain: princeton-edu.com (which doesn’t exist).

I am deleting all of them after I tried to contact some of them. What can a registered user as a Subscriber can do to damage a WordPress site?

What can a WordPress Admin do to avoid bulk registration or prevent any hacking to be happened?

I have installed the Back up plugin so I will make a Back up and I must say [****] the HACKER! The website is a NON profit organization that wants to help poor young people in the world to study and get a better life. Everyone should support and not attack but the someone is CRAP.