There appears to be a serious security hole with Wordpress when public registration is available: http://www.jason-roe.com/blog/serious-email-spam-issue-for-irish-wordpress-blogs/
Yeah, there were two security updates for wordpress the last two weeks. I learned about it the hard way. One guy posted as guest to my blog.....