user able to register, all site options disabled?

Have a site in build, was shelved for a year. Recently updated to 7.1.4

have set to invitation only, emails need confirming, recaptcha in place, additional human test block in place...

STILL getting hundreds of spam account registering every day!!! They are also able to confirm emails.

Almost seems like something has gotten in the back door to open direct link to the join process bypassing everything in the front end?

Anyone seen this before?

Any thoughts on what could be giving this vulnerability (if thats whats happening) or how to test to find it?

The invite system is pretty easy to break - http://example.com/index.php?idFriend=1

There.  Invite code from the admin account.

I'd recommend enabling the antispam tools in Dolphin, especially the China blocklist.  Deano also has his own antispam module in the market that has been well received.