many users being added on magento 1.9.11 after last patch

[stefanita rares]

Hello,

We have a bunch of magento 1.9.11 sites that are experiencing a weird behavior: A lot of users are being added by someone in the database, with no details, just a password.

This started happening after we applied a series of patches: SUPEE-11219, SUPEE-11295, SUPEE-11314 and SUPEE-11346

the post requests are done on various urls, but we haven't found anything weird in the code.

./index.php/customgrid/custom_grid/index/

 ./index.php/shippingtablerate/adminhtml_tablerate/index

does anyone have any ideas on how this could be avoided? 

for some reason the image i upload gets converted to the triangle logo. not sure why.

thank you.