Since a Joomla user is created, there are one of a few scenarios you could be encountering:
Joomla's user registration isn't disabled
I don't know how to disable user registration in Joomla, and there are some scenarios where you can't. Your mitigations are:
Turn off user registration (only admins can create users).
Edit your web server configuration to ...
One of the steps we did in Civi was to set our Available Countries. This does not allow user registrations unless they are from within one of the countries on the list. Most of the spammers are operating in specific countries, so if you are not needing the whole world to have access to your forms, then you can do this to block out a large % of these guys.
You could do that with the API:
$result = civicrm_api3('Membership', 'get', [
'sequential' => 1,
'status_id' => "Transferred",
'options' => ['limit' => 0],
'api.Membership.create' => ['id' => "\$id", 'is_override' => 1],
(Find all memberships with status 'Transferred' and set override)
Or in Explorer:
I've also encountered this issue. In a profile, some of the custom fields are displayed, but some are not, all within the same single profile.
Clearing civi cache files resolves the issue for a little while, and then issue returns. Digging into user permissions, we found that some Joomla user groups had permission to "CiviCRM: ...