I have the full TAC suite installed, and I've not been able to locate their details in any of the logs in there, so have to presume they are registering via TapaTalk, as that is the only other method (have the Facebook Captcha add-on installed) that would allow them to bypass the usual protection method.
I've just tested on my own forum, and with TapaTalk, you just select a username / email / password, and you are registered. You still need to activate your account, but it's bypassing all the spam protection.
Just something to be aware of. I've disabled the option to allow people to register in app, but it's still allowing them through, so I'm reporting a bug.