Spam bots are probably finding the user URL (http://example.com/user) and the subsequent 'create account' link.
You need to prevent anonymous users from creating accounts.
In Drupal 6 visit admin/user/settings In Drupal 7 visit admin/config/people/accounts
Alternatively, if you do wish to have anonymous users create accounts but prevent spam, you could add a captcha to the account creation form.
Carl Wiedemann Website design and development consulting carl.wiedemann@gmail.com | skype: c4rlww