Support

Given that Joomla! 1.5 does not have an interface to create extra user groups, I suppose that this is a hacking attempt. Make sure that you have enabled all of Admin Tools' security features, especially SQLiShield and administrator query string protection to make sure that an attacker can not directly attempt to create rogue users and that even if they do they can not log in.

That said, I suggest immediately doing the following:
- Change your super administrator username and password
- Change your FTP and database username and password. Remember to update your configuration.PHP file with the new database credentials.
- Follow our unpacking your site guide.
- Disable the suspicious user accounts
- Make sure that ALL of your extensions, including your template, are up to date
- Check that these groups have not been created by some legitimate software, e.g. some social component

Well, it seems like you are being bombarded by known hackers, spammers or email harvesting bots. Nothing to worry too much about, the fact that you receive those emails means that Admin Tools dutifully does its job to protect you.

I would also suggest to enable the "IP blocking of repeat offenders" option. Recommended settings: "Block after" -> 3 attacks in 5 minutes; "Block this long" -> 30 minutes. This will automatically block repeat attempts to your site from known IPs to the HTTP:BL.

As I said in my earlier reply, it's paramount to have SQLiShield enabled and make sure that all extensions are up to date. Also check that none of your extensions are listed in the Vulnerable Extensions List in red (green items are extensions which have resolved any security issues in their latest versions and are safe to have installed and up-to-date on your site). If any extensions are listed as red, uninstall them at once! Extensions marked in red are vulnerable and, depending on how they work (that is, if they bypass Joomla!'s index.php files), may be used to compromise your site despite having Admin Tools installed and configured properly.