Fake User Accounts apearing - What am I doing wrong?

I´m relatively new to xWiki and just startet a small one hosted on a Debian V-Server.
Until now i created 3 Users and i tried to configure everything in a way, that its not accessible without an account. I recently discovered that i have a lot of fake accounts on my system now. First and lastname are always random string, the email used is always ending with “@outlook.com”. I have no registration page activated. Prevent unregistered users from viewing pages is ticked.
Seems like a serious security issue to me. What have i done wrong?

Thank you for helping me out!

Did you deny „register“ for unregistered users explicitly?


Thank you. Thought this is default… I did it now, lets see if this prevents it.