Thousands of users, but they aren't subscribers, who are they?

That many hidden users is suspicious; your site may have been hacked. You can look in the wp_users table in the database to see if there really are that many users. Use https://www.ads-software.com/plugins/adminer/ or phpmyadmin in your hosting control panel.

If there are that many hidden users, it will take an SQL query to remove them, along with corresponding data from wp_usermeta. And then you will need to carefully follow https://codex.www.ads-software.com/FAQ_My_site_was_hacked

Any suggestion of the query to run in phpmyadmin?

wp_users table shows the correct number of rows, not the massive number. So I’m wondering where the large number comes from. Is it from the wp_usermeta table or something?

Have you emptied spam comments?

Oh yes.

Could be wp_usermeta. How large in megs is that table in the database?

wp_usermeta is large. very large. 688Mb. I’m wondering if this is left over stuff from a very old version of wp-ecommerce or something (but … don’t let that cloud your amazing help, mr songdogtech!).

It *is* a very popular website. And it *has* been going since 2009. But…
I wouldn’t know how to weed out good stuff from bad in wp_usermeta.

wp-ecommerce will do that; I’ve had to clean out old wp-ecommerce and woocommerce database transients and users that didn’t get deleted by cron after sales were completed. It takes a very specific query, depending on what’s in the table, and to not delete usermeta you want to keep.

I’ll dive into it. AND back up first ?? Star.

Well. Good news. They were indeed left over transient users from an old version of wp-ecommerce. I’ve had all these rows in the database, clogging it up for YEARS!
The relevant post was https://www.ads-software.com/support/topic/spam-users-in-wp_users-after-wpsc-upgrade/page/6?replies=179

And, having backed up first, and then checked that my wp_users table was 100% cool, I ran the following command in phpmyadmin
DELETE FROM wp_usermeta WHERE user_id NOT IN (SELECT ID FROM wp_users)
It removed a massive 6307223 rows from my database, and removed nearly 500MB from the wp_usermeta table.
Everything seems to be working still (phew), and best of all, the number of users on the users page is back to the right number.
ALL GREAT. Thanks songdogtech.

Good that it worked….