Mitigate automated user registration spam

[Ambient-Impact]

We're currently getting an bunch of automated attempts at registering new users that never log in, so we need to figure out what to do with these. Enabling Honeypot protection for the register form doesn't seem to help much to slow down the rate at which they get through. A good policy may be to auto delete user accounts that are older than a certain threshold (7 days?), have never logged in, and (important) do not have any user roles assigned. The Auto Purge Users module looks like a good solution for this.