All the members are in the default group USERS.
The default group is "Registered Users", I suppose you are talking about that?
Best way to find out how this might have happened is to create a new user and retrace all the steps the spammer did take.
Since you did not mention it, are you sure there are no permissions set on the individual boards? You might have set them a while ago and not checked them right now, and I think board permissions overwrite group permissions, unless the latter are set to "never".