How are bots bypassing email activation?
 

I have email activation set up as a registration requirement on my 3.8.2 forum.

I have bots register then immediately activate their accounts (instantly). This is despite the activation email not even being sent yet! Then when the email is sent it bounces anyway.

How are they able to do this? Where are they getting the activation codes from?