the fix was to stop the guest account from sending PMs. nothing stopping registered users from doing it, which is where the ones i've been getting are coming from. they're all template names (female-sounding first name plus two digit number) so they're easy to spot.
i'd be flabbergasted if...