Lmao yeah that pretty much looks like what they were using.

But the way I took care of it was just deleting users who hadn't completed their email verification within one hour. The bots haven't actually done email verification YET