Strange Redirect – Security Issue

Hi,
I have started a Multisite blog network and i am facing a strange security error.
Everyone is allowed to create blogs on subdomains and they should be browsing their sites through their subdomain only right?
but some users creating blogs that redirects to some other domain when visited.
i checked my .htaccess and there is nothing hacked in it.
i noticed all of them were using “twentyfifteen” theme is it possible to subdomain users to modify this theme files and place redirection code in it ?
i have deleted such suspicious blogs and users but am worried for future i can’t check every blog when users raised from 150 to 150K