Please check that Joomla registration is disabled and you've CB registration configured to be independent (see documentation for details). Please then check within CB configuration on the integration tab that you've session spoof checking enabled. We use a spoof string and a check against it so it's impossible to spoof it, but if this feature is disabled it would then be possible to spoof a form (some sites have complications so this parameter was made available). Please also ensure you're using CB 1.4. If done checking you may want to consult with your staff to ensure they're not making accounts via backend.

Sounds like a spam bot, fields are HIDDEN on registration.. they're not removed. They're just taken out of the visual spectrum. Review the source and they're still there. So a spam bot parsing through your registration can see and complete them just fine.

I suggest installing and using CB Captcha or some other form of captcha such as a "honey pot" field. This field would as a simple question as its name such as "What is 1 + 1" then using PERL regular expression as the validation for that field you'd simply put /2/, anything but 2 will fail. MOST bots will never bypass this. Real human spammers will have no problems.