If it’s a recent big wave, then I’d guess a bot of some kind… much of the internet is now under regular bot hammering… these accounts will remain useless until activated, so I’m not sure why someone would create and then abandon them though.
Someone created an account, never verified the email, and therefore can’t log in. Without activating an account, it will never have a seen record.
Discourse is one big API, so someone can directly access the same endpoints the interface does to create an account. It’s certainly possible to automate, though someone doing so would have to work around rate limits to create many accounts quickly.
From admin/users/list/new there’s a “not activated” filter
From here you can click the icon over the avatar in the table header to enter bulk select mode. You can delete accounts this way if needed.
Discourse will automatically delete these after 14 days by default as long as they have no posts, the relevant site setting is purge_unactivated_users_grace_period_days.
If you select one of the users and go to their admin page, you can also use the “IP lookup” button to see accounts associated with the same IP. If multiple accounts are associated, you’ll get the option to delete them:
You shouldn’t need to do anything manually and can rely on the auto-purge… but maybe worth keeping an eye on if there are many accounts or if some are being activated to create spam.
Are there any patterns? same location? same IP? same email domain? You can consider adding more protections if there’s a tell of some kind.