I see! I have a feeling that these users are from the "22" users that were allowed in! Sign up first, spam later, after all suspicion is gone!
I am going to create a new account, with the username, test12345, to see what security borders there are. I'll delete it afterwards!
---------------
Here's what I noticed:
Your Captcha is very simple. It is possible to OCR it.
You have a good question verification
You do not have any e-Mail address validation. You might try looking for a plugin that verifies email addresses by doing a DNS lookup.
Put some harder questions, that make the user think. We are robotics students. We have brains! Zombies, please don't come after us
Have some plugins, like Stop Spammers or Askimet afterwards.
You may want to look into reCapatcha. On my forum, I used to get 10 spammers a day, until I installed reCapacha.
Try keyCapatcha! Not only is it really good, it is fun too!
Good Luck