Based on the default settings when I installed SPF, all existing WP members were automatically assigned to user group Members. The risk is that any spam merchants who registered on WP over the past 3 years now have instant access to PMs if they log into the forum plus permission to set up a sig.
Suggestion:
Configure the default settings in the dowload ver. Add a new User Group explicitly named New Members with permissions Limited Access. Automatically assign all WP members to this User Group upon install, only if it is a new install.