I have one website that must have some malicious back door in the theme or plugins. I don’t use the site much and haven’t maintained it well but this is also not the first time I’ve had comments turned off and anyone can register turned off and STILL got flooded with spam accounts and (unapproved) comments littering my database. This plugin removes the ability to register or comment completely, back doors and all.
Edit: Now live in WordPress.org Repo: https://wordpress.org/plugins/block-disable-all-new-user-registrations-comments-completely/
Feel free to try it out here: http://whoischris.com/DABARACC.zip