I know at least at the start some users were confused by the federation process and created 10+ accounts to "subscribe" to other instances plus there have been bots signing up through smaller instances without capcha or email verification so that might explain the discrepency