2
This is the first time I hear of that.
Do you enforce during registration that the user has to confirm his email? If not, you should!
Are these two sharing same or similar IP address? If yes, you could block it
And how do you know that it was a bot, and not a person who first registered with your website, and who is paid for promoting some stuff?