Constant user password reset emails

Lately I have been getting a ton of emails saying a user has done a password reset. I get at least 5 a day or more.

They’re all spam accounts. I have ban lists and even have a password reset plugin that is supposed to disable user password resets. Obviously it’s not working.

Does anyone else have this issue? Any ideas on how to keep this from happening besides disabling user registrations??