Preventing someone from creating thousands of users
this is probably just a bot or your site really work, but in case what you can do is, do authentication of email, set up an SMTP server and send some code/numbers/link to the registered emails and once verified then add them in a database or just set a  certain time for email authentication and if time passed then deletes the data/record for that email/user login credential.
or 
you can record the ip from which it is registered, and see if all the emails are registered form that ip, the block it if too many ( just a filter)
I made a simple Flask app that has no sort of auth since it doesn't really require it. Today my database reached 100,000 users when it normally gets about 5 in a day. I looked at my analytics but saw no one has been on the site in the past hour. 
How are they creating this many users so fast and how can I prevent it? I had to take my database offline since it's been happening all day.