They're either using the confirmation links being sent to them or you've a backdoor registration somewhere. There's nothing you can really do about them using the confirmation links. I'd recommend using CB AntiSpam and providing a captcha of some kind to help reduce the spam, but this is basically the world we live in now as bots get better and better.

As for backdoor registrations can happen if you've a 3rd party extension that has a registration feature. Typically the best way to turn off other Joomla registrations is to explicitly turn Joomla's off. This is done by going to Users > Manage > Options and turning registration off then in CB > Configuration > Registration ensure CBs is enabled explicitly.