My thoughts exactly. If the bots are able to get around the paywall there must be a backdoor in wpForo they're getting through.