It seems that a robot is creating a lot of user accounts on my website

Solution 1:

1. Yes this is a pretty standard attack that happens to many ecommerce sites. I believe the main goal in this case is to send spam emails to the addresses specified (because you will send a "please confirm your email address" to all of them). This will be bad for your reputation (e.g. if you use AWS Simple Email Service you will run into trouble at some point, or your mail server will be blacklistet etc.)

2. The most commonly used mechanic to prevent things like this is to use a captcha. There is no simple "switch this on" method because it needs to be integrated into your software, e.g. evaluate email addresses specified in order to classify as spam or ham.