Why are we getting anonymous account creation on a site where this is turned off? On one of our Drupal 7 sites (it's at v. 7.32) we're getting occasional 'bot based account creation requests. This is an information-only site where regular users will never log in, only administrators should be allowed to create accounts and only administrators and content creators can log in.

In Configuration under People "Who can register accounts?" is set to "Adminstrators only." Is that not sufficient to stop this from happening?

The accounts are being created but the admin email is being contacted to approve them, so these users are not actually able to log in, but we'd like to stop this account creation altogether.

Has anyone ever seen this?
Does your drupal version is up to date ? 

Versions before 7.32 need a fix to protect your Drupal from SQL injection ...

https://www.drupal.org/SA-CORE-2014-005

Theres a link to a patch if you cant do the full update