How are spam bots registering?

[WeBBy]

vbb 3.87
This one has me puzzled.

vbb is installed in a password protected site (parts thereof). In order to register,you have to join the site and pay through paypal. The payment success from paypal triggers registration in the primary login, vbb, and a few other features automatically. The index.php of vbb will automatically login the person IF they are logged in on the primary login.

The vbb register.php has a php 301 permanent redirect BEFORE the vbb code.

Some how bots are registering??????

The bots are not getting access through the primary login because they do not get registered in the primary login script and are not subscribed to the forums (all done automatically when registering through the main login script).

All the evidence suggests that the bots are registering through vbb and NOT vbb register.php.

So, how are they registering????

Any thoughts on this one would be really appreciated - I am stumped!