Spam email and signups – unable to block

I run a few medium sized woocommerce installs and one is experiencing a flood of user sign-up spam, which causes a flood of email.

I’ve disabled user sign-up completely on WordPress > Settings, but signups continue. I tried blocking access to xmlrpc, but the block rule isn’t seeing any hits.

I’ve also used several plugins to try and stop the resulting emails from signups and password resets on these spam accounts, but nothing is working.

Any suggestions? I am almost at a loss for what to try next seeing as these basic controls seem to not be functioning for me.