yeah, they can see everything as it is setup now. I am really surprised we don't have spam posts because all of the new users are definitely bots. I can't remember how to get into the joomla and/or agora admin interface to delete them. I guess unless we changed the configuration or updated the site, they'd probably just create more accounts anyway.
1. Bots are not users. We've had very few actual new users to the site. They have to go through Captcha, be email verified and have an admin approve them before they can post anything.
2. I've removed accounts that have never logged in or haven't logged in within the past year (didn't see any familiar names besides John... who I did not delete).
