Unwelcome Subscribers

I have a two-year-old site that I am re-working, and it is now functional with WP 3.5.1. BWPS is installed but not turned on, so this is more of a general question.
Today, I got an email notice that I had a new user registered, from Russia as a subscriber. The settings box for “anyone can join” is NOT checked, and I erased the user as soon as I saw the notice.
My question is, what mechanism does a hacker use to register as a user – a subscriber in this case (that is the setting below the check box, I’m glad it was not set at administrator!), even though signups are not allowed?
Where is that controlled in BWPS? I will be setting up BWPS in the next few days, and that would be a good thing to know. I had the same thing some years ago on a 2.x WP blog, but I haven’t seen it since then, as far as I can remember.
The site is https://ilianasblog.com/

https://www.ads-software.com/extend/plugins/better-wp-security/