Hm, turns out Drupal allows the whole world to create accounts by default. Yikes.