I have iThemes Security Pro installed, and am configuring the settings for my two sites. The answer they provided earlier today about how to stop the bots was to force the recaptcha for registration. It can't be undone..