Step 1: Ensure Your Signup Forms are Not To Blame
First, check to make sure that your opt in forms are not allowing the spam signups. (A quick check: if the users exist in AccessAlly, but not your CRM, then your forms are not to blame.)
Step 2: Disable “Anyone Can Register” Settings Inside AccessAlly Site
If the spam signups only exist in your membership site (and NOT your CRM), go to: Settings > General from the WordPress menu on the left and look down the Settings page…
Do you have the box checked under Membership anyone can register?
If you do, uncheck it and save your settings.