there are many spam fighter olugins in the comminity.

First, make sure you are running the very latest version of Elgg.

Second, if you search in the plugins repo you'll find a number of anti-spam plugins.

Even though you don't have a public registration form, the registration URL is still public. If you want to disable registration, be sure to disable it in the admin interface.

In my opionion in this case a plugin that set as default new user disabled.
In a second time the admin can enable or delete the new user.

Probably changing the user registration by email can prevent this. Unfortunately I'm not so expert.