Thousands of phantom contacts being created

Question

I have a CiviCRM 5.76.2 installation on a WordPress 6.6.1 site (not on wordpress.com). I just noticed that I have over 4,000 contacts in CiviCRM that have my email address (and nothing else) as contact info, and the number is growing every few minutes:

mysql> select count(*) from civicrm_contact c where id in
   (select contact_id from civicrm_email where email='[email protected]');
+----------+
| count(*) |
+----------+
|     4226 |
+----------+
1 row in set (0.02 sec)

mysql> select count(*) from civicrm_contact c where id in
   (select contact_id from civicrm_email where email='[email protected]');
+----------+
| count(*) |
+----------+
|     4228 |
+----------+
1 row in set (0.03 sec)

mysql> select c.created_date, c.modified_date
   from civicrm_contact c, civicrm_email e
   where e.contact_id = c.id and email='[email protected]'
   order by c.modified_date desc limit 10;
+---------------------+---------------------+
| created_date        | modified_date       |
+---------------------+---------------------+
| 2024-09-02 17:51:02 | 2024-09-02 17:51:03 |
| 2024-09-02 17:51:01 | 2024-09-02 17:51:01 |
| 2024-09-02 17:50:40 | 2024-09-02 17:50:40 |
| 2024-09-02 17:50:39 | 2024-09-02 17:50:39 |
| 2024-09-02 17:50:38 | 2024-09-02 17:50:38 |
| 2024-09-02 17:50:36 | 2024-09-02 17:50:37 |
| 2024-09-02 17:48:39 | 2024-09-02 17:48:39 |
| 2024-09-02 17:48:38 | 2024-09-02 17:48:38 |
| 2024-09-02 17:48:37 | 2024-09-02 17:48:37 |
| 2024-09-02 17:48:36 | 2024-09-02 17:48:36 |
+---------------------+---------------------+
10 rows in set (0.02 sec)

This is a very low-traffic site, there's definitely no other person inserting these users. There must be an automated process doing this somewhere - but I can't figure out what it is.

I only have two active Scheduled Jobs in CiviCRM, and they just run daily & hourly:

And my system cron only has the following jobs (this is the contents of the shell script that executes), run hourly:

~/private/bin/cv api job.execute --cwd=/home/example/www/wp

BACKUP_DIR=~/private/backup/wordpress-site
BIN_DIR=~/private/python-venv/bin

cd ~/www/wp && /usr/local/bin/wp db export - | gzip > "$BACKUP_DIR/full-db-$(date '+%FT%T%z').sql.gz"
"$BIN_DIR/rotate-backups" --hourly=10 --daily=7 --weekly=5 --monthly=12 --yearly=10 --include "full-db-*" "$BACKUP_DIR"

cd ~/www && tar -czf "$BACKUP_DIR/files-$(date '+%FT%T%z').tar.gz" wp
"$BIN_DIR/rotate-backups" --hourly=10 --daily=7 --weekly=5 --monthly=12 --yearly=10 --include "files-*" "$BACKUP_DIR"

There are no logs at /wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fadmin%2Flogviewer that shed any light.

What could possibly be doing this? Can I turn on some extra logging to show what's creating contacts?

Answer 1

Based on comments this was a migration that had a leftover civicrm_uf_match record pointing to a non-existent user record.

To also answer the last comment about how to avoid in future, one idea is a system status check that lists uf_match records that point to non-existent users or contacts.