I did it in the database, so if you can access your database I can assist.
My instance also experienced this. I'm the only active user (I made it a day ago), but the user count is up to 2K now. It stopped after I enabled captchas, but I want to remove these spam accounts so they don't cause issues elsewhere.
I don't even have a slight clue as to what I should look for in my database.