I removed the account name from join form, so it defaults to User #. It was confusing to have to have two different names.

But it was definitely Antispam module. With it disabled, that spam message goes away.