This is what I changed yesterday:
When you don't select "require validated users", only anonymous users can use the free profiles. When you login, you don't have access to free profile, so there should be no more abuse.
I double checked on your hotspot, and don't see the "hole" anymore.
Could you please confirm there is still a hole, and your procedure if there is one.
Thank you