Re: Spam/bogus join requests
All the ones I checked had registered on the website. The emailI guessed wrong about email versus website, which means the addresses aren't necessarily compromised accounts.
That the addresses are valid is consistent with an experiment I tried. Entering an invalid address (from a valid domain) on the website resulted in a blue "B" (Bouncing) status rather than "NC". Entering an invalid domain (example.com) gave an error to the user and didn't create a pending member at all.