Bogus users now wanting to change password

I’ve been battling a constant swarm of “new users”. I routinely delete at least 20 per week. This week I received a n e-mail from Blue host/my web host that someone requested a change in password.sure enough the entity in question was someone who had recently become a “user”
I notified blue host that i did not authorize this and that i wanted it blocked. I also deleted the “person and their content.
Blue host said it was because my privacy controls were disabled and i could pay them to enable them.
well today the “person” who requested a password change appeared in my users again.
Is this as menacing and evil as it seems or is it just another robot????