Oh! This is important!
Discourse is assuming that your Wordpress site is performing full vetting of all the accounts before allowing them to sign on to the forum.
So all of the Discourse spam protections - blacklisted email domains, IPs, per-IP ratelimits, javascript-required two-click account activation, “per-IP user limit until one of them comes back on 15 different days” - are effectively turned off.