Why are we getting anonymous account creation on a site where this is turned off?
Does your drupal version is up to date ? 

Versions before 7.32 need a fix to protect your Drupal from SQL injection ...

https://www.drupal.org/SA-CORE-2014-005

Theres a link to a patch if you cant do the full update