Thinking we have a spam email from a class member. He joined the website on Aug 4, 2018. Received notice that he passed away July 27,2018.
I removed his email and left info on his obit page of the issue for classmembers.
Not sure what else we can do to protect site besides confirming they know the answer to a question that class members would know and make sure pages are protected from information on website.
Thanks for any suggestions & ideas. Kk

Since you have an obit, I presume you are positive the member has passed. If so, I'm wondering if a relation of his decided to join your site, perhaps as a tribute to him, and this is not a nefarious attempt to penetrate your site.

It sounds like you're aware of the option for administrators to verify a new member, which you access by:

Admin Functions
Preferences
Under New Classmate Verification, check the second box

I checked the list of relatives and it didn't look like an email that they may have, no name connection. I did go back and changed the email to our website and gave it a password. Hopefully if a family member did join they would asked why it changed since they were notified when I deleted & changed their email. But then if they click on forgot password would they see the password I gave them??? Then change their email again? I did make note of previous email in Admin box for future reference.
BEWARE Website users take advantage of the Classmate verification procedure.

If you changed their email address any attempt at a password reset would go to the new email address not the one they had in there before. They can't change the email address without logging in and can't login without a valid email address and password.