Create account with registered domain

Hi, I have allow remote domains set to off, and allow unregistered domains off. The problem is, when creating accounts we can use any domain regardless if it's pointing to the server, or not registered. A reseller has created 400 accounts with domains that don't point to us, or are registered, how can we prevent this, the settings above don't seem to work with account creating.