Just a quick update for everyone, yes OP is right and a bunch of bots signed up. We've purged them from our user count and enabled CAPTCHA. Email verification is coming soon as a secondary deterrent.
For the record nobody told us that it's not safe out here. We were aware that self-hosting was wondrous, with treasures to satiate desires both subtle and gross; but has NO IDEA that it wasn't for the timid. 😉