since 29 May 2013, Spritesmind is under attack

A spam bot create several members per day with nothing but website.
No post so no ip to ban....
I had to find how it did this but I also need to clean the member list...
I discover some spam users were also created before this time.
So, I'll need to do a major request to clean them :
ALL USERS WITH A WEBSITE ON THEIR PROFIL AND NO POST WILL BE DELETED WITHIN A WEEK
It's the only way I had to be sure to clean everything...
But for now, I had to find the exploit it's using...

ps: thanks a lot to Graz !