Spammers are "bypassing" my signup process.

I have a multisite 3.2.1 site. I am getting some spam signups (manually processed, I don’t have a problem with bots). I do expect some manual signup spammers but the problem is that they are signing up by “bypassing” my regular signup process. That’s what worries me.

When a normal signup occurs, they are automatically a member of the main site https://mysite.com, under Sites in the User Admin area. However, for the spam signups there is no site at all listed under Sites (it’s just blank) when viewing them in the User Admin area. How is this possible and can I stop them from signing up through there? (wherever “there” is)

Thanks!
Matt