By default, people who can access your instance while unauthenticated can create a new personal account on your instance.