Ok, I've tested it and I thought it worked. Lo and behold today I log in to find a new member on my brand new site even though I enabled registration by invitation only.
They weren't able to confirm but they did manage to post a big spam diatribe to the site. The registration process had been completed.
Explain?
