That is, do you allow anonymous users to email in?
how to check this? there is a settings enable staged users which says Automatically create staged users when processing incoming emails. and it is checked. is this what you are asking?
This is how that spam account permission looks right now.