Anonymous spam comments when only registered users can comment

You probably have alot of bots creating the fake usernames/pass. If you’re using Buddypress then you will get lots of bots. Try NoMoreCaptchas, it authenticates the user as a human or bot via a new type of technology called BioChronometrics. This is super fast for the user since it is completely passive authentication. It’s based on user behavior.