Yes, I've never enabled self-registration.
AFAIK, the issue here https://github.com/collective/collective.emailconfirmationregistration/issues/8 is likely still due to multi site deployment related problems. Spam should be at a minimum with that implementation. If not, there is more hardening that needs to be done; however, I don't know what more you can do at that point.