Since a few days accounts keep on getting created by a bot.

I have Recaptcha configured however it seems this only works for forms but not for the most basic and standard use-case: login/password reset/signup. How do I enable this basic feature for signup/password reset?

I don't see what's to gain from creating these random accounts. But I do see first a signup immediately followed by a password reset.

Now when I'm trying to cleanup the contacts I get this error:

"You cannot archive a contact linked to a portal or internal user"  res_users_partner_id_fkey

How does this partner id get established when signing up? And how do I find which contact that is? I can't see in any of these contacts what the linked account would be.