If they are spam users, then of course they will get the spam reset requests. The only option at that point would be to remove the users from being able to post. If you know they are genuine users, its possible they have compromised email accounts I would guess. In any case, if they are getting in with genuine login details, even after having them reset the password, thats not really a software issue unfortunately.