Perhaps by limiting the rate at which password-free accounts can be created. If this limit is exceeded then the system switches back to creating user accounts in the normal way.

And what if they want a lot of users? How do they know which are legitimate?