Registration-spammed forum with aliased email addresses despite "normalize_emails" enabled

Support
1

My forum was registration-spammed a few months ago using aliased email addresses.

The image is a screenshot of a CSV file showing 913 rows with columns for email type, to_address, and created_at, representing email signup actions with a completion time of 5.0 milliseconds. (Captioned by AI)
The image is a screenshot of a CSV file showing 913 rows with columns for email type, to_address, and created_at, representing email signup actions with a completion time of 5.0 milliseconds. (Captioned by AI)1090×1061 110 KB

Activation reminder emails were also sent, doubling the number and sending a total of around 1000 emails in a very short time.

I was advised to enable the normalize emails setting. The default state is enabled and was never changed. The admin actions log confirms that.

Should this setting have prevented this abuse?