Users not on memberlist being spammed by PM's
 

We're currently experiencing a small attack by a select number of users who are spamming people with PM's which contain links to a website.

I'm having trouble figuring out how they are managing to spam some of the users who don't appear on the memberlist. Users who have a post count of zero and who have never used the forum, are logging in for the first time and reporting having recieved these spam PM's - even though they do not appear on our memberlist.

How are these spammers able to send a PM to these types of users?