I have the require email confirmation setting turned on. However, it still registers them before confirming their email address. This sort of leaves me susceptible to registrations from email addresses that the account creator doesn't actually own. How do I fix this?
This is WordPress User Registration API, this is not wpForo API, wpForo just uses it. You should ask this question to WP support. It registers users but users can't login, because they don't have the Password which is being sent via email. This is the Email Confirmation Point. Without email address they can't find password and login, but the account is created. And it'll be inactive forever.
Use this at your own risk. I haven't tried it yet.
https://wordpress.org/plugins/inactive-user-deleter/