New admin users are being created but wp-signup is removed

Good day everyone!

I hope everyone is well.

I worked on a few sites and somehow, new admin accounts are being created constantly. The email addresses are completely random, so I’m sure that it is spam attempts. The default role of a new user is set to be a subscriber in the settings, but all these new accounts are admin accounts when created. I have gone ahead and removed the wp-signup page (I just renamed it to wp-signup.php.bak) to make it inaccessible, but the new accounts are still being created.

No changes have been made to the website from these accounts, but I have no idea what more to do to prevent this. I am sure that my admin account isn’t compromised as I have changed the username and password, yet it is still happening.

Does anyone maybe have a suggestion on what else I can do?