It was three user accounts. Whenever we closed one, they registered a new one. I think it was a real person creating the accounts cause they didn't make a ton of those. Then they used a bot to auto-create the groups so I disabled group creation.
Idk, I can try implementing it on the registration form, but not sure if its a real person registering.