Registration without payment

Hi!

I have some people who found a way to register for my wordpress site without paying. After clicking lost password they get to ../wp-login page where they can register for the wordpress site. One somehow even got access to a course that way. How can I turn this off and still have people request a new password if they lost it.

Thanks!