We have been having an attack on our forum, whether malicious specifically to us or aimed at Freeflarum, I don't know.
I noticed much more user registrations than normal, happening every few minutes at first then every few seconds in waves. the usernames took the format 6I61WPK or similar, numbers and capital letters mixed.
This made it easy to identify these users, however Flarum does not provide tools for mass deletes, which is annoying.
I don't use e-mail veriification as it won't stop this and will add more server side load. So the actions I took were to add hCaptcha (not rCaptcha) to the forum. As the captcha is not handled at the servers, it basically prevents registration with hopefully minimal server activity. This has immediately stopped these accounts being created.
I say malicious, because the accounts are created, but post nothing. Although leaving them on the forum creates an additional risk. I removed them all and to do this used an auto mouse mover and clicker. https://thetinytask.com/#download-tinytask-177
It runs as an executable and from the user directory screen can be used to relatively rapidly delete 100s of users. It's the simplest thing I found. I use speed 6 and simply add the appropriate repetitions required.
