By default users cannot register unless you enable them to. This is a Joomla setting.

However, when using components like rsforms, chronoforms, virtuemart, hikashop or community addons that allow user registration, just disabeling the user registration in Joomla itself is not sufficient for protecting your site from unwanted users. These components can override this setting, making you think you have things covered, but that is far from the truth. So when you get users that register and you have no clue where this is coming from, see what happens when you type in this url:

index.php?option=com_users&view=registration&Itemid=999


If this page shows a registration form, some kind of registration is possible. How to fix this: 

• If you want users to register, allwas use a captcha of some kind
• Disable user registration in Joomla
• Check all components that allow user registration, to also not allow users to register, or let these components make user of the default joomla registration option,