spammer keep posting even I switch on the email confirm for user registration

I have a very strange question here:

there are lots fake registered user ( around 30 a day) post node on my site, the node they posted even including a required image field, I guess they registered automatically through some program, once registered, they start to post immediately. (no need for email verification on my site) and they can post on a content type that I do not show on the site, which makes me think they post through a program not by human.

THEN, I changed the system, after registered, user need to confirm their email first, then they can login to post, but even this, the fake users still keep registered and posting on the site,

anyone can tell me those fake user they manually confirm their email first? I don’t think so, how this happened,  is some sort of bug in drupal ?  I am in D7 LATEST version, or my site being hacked ?

Please advise, thanks

Drupal version: