The pattern seems to be: a bot/person finds a crack in the security and creates a bunch of users, assuming that at some point that crack will be sealed. They won’t draw attention yet as that will encourage the security problem to be addressed. Instead, they hope the new accounts will blend in. Then, slowly over time, they can use those accounts to post adverts or scam inside the site. Delete one account and there are others waiting dormant.
Our advantage is that being a small site, the sudden surge of new accounts usually gets noticed.