One has noticed that there are some users/contacts registered in the instance and added to an organization even though they have not been manually added in the Staff Panel.
Besides registering users through the Staff Panel, users are also able to register themselves through the helpdesk by default. Having said that, one can disable the registration link on the helpdesk if required by following the steps in the Disabling the User Registration Button From the Support Center article.
Other than that, users are also created/registered when a new email is received and generates a ticket. To prevent this from occurring, one can Restrict the Email Queue to Accept Emails from Registered Users Only so that emails from unregistered users won't create a ticket or a user.
Lastly, it is also possible someone else from the Staff team created those accounts and one can confirm this by reviewing the Activity Logs in the Admin Panel following the Identifying and Checking Changes Made Within the Instance article.