WordPress: How do people register even though registration is off?

A question for the lazyweb, as I didn’t find an answer immediately via Google… how is it that I’ve seen a couple of random people register new user accounts, doubtless for nefarious purposes, even though I have user registration turned off on my blog? Yesterday, I even renamed wp-register.php, figuring that people may have been posting directly to the script. Is that not the right script?