The good people at ProcessOne noticed my dent and blog post about ejabberd’s default configuration. They have already committed changes to restrict MUC room and Pubsub node creation to local users and have opened a ticket to discuss disabling in-band registration.
Thanks ProcessOne.