One-time link without valid email address Spam Registrations
I can only think of a few ways this is possible:


There's a vulnerability in the one-time-login link system for new users (I'm not aware of one)
There's a vulnerability in some other module (in which case please give some more details of what modules you are running)
Your server does actually resolve the domain hotmailit or has a default place it sends mail and thus the mail is being delivered to somewhere which is then getting the login link and spamming.
Something about your configuration is different than you've described it (e.g. Users do not have to be verified before posting)