It is not malware.
There’s no setting currently to disable. You could remove the line of code that creates the custom post type. But you would then have no record of submissions if they used the form.
We understand the confusion and are making this an optional feature and moving from custom post type down to tools so this will be forthcoming asap.
To better understand your specific case, are you a webmaster and speaking about other companies/multiple different websites as your clients?
Or for one specific company/website are you mentioning that they have clients that can login to the site using wordpress permissions?
can you tell me for your ‘clients’ what wordpress permission they are logging in as? Do they have admin access to your site or editor or otherwise?
This will help us determine the best approach for hiding/disabling appropriately from specific users or all together.
Thank you for your candid feedback!
Also you may email us directly at [email protected] to respond.