Great question — answering as the UphillTech team:
I had around 17,000+ spam users in my WordPress account. I ran a SQL query through phpMyAdmin, and it successfully removed all the fake users. DELETE FROM wp_users WHERE ID IN ( SELECT ID FROM ( SELECT u.ID FROM wp_users u LEFT JOIN ( SELECT DISTINCT CAST(meta_value AS UNSIGNED) AS user_id FROM wp_postmeta WHERE meta_key = '_customer_user' AND meta_value != '0' ) customers ON u.ID = customers.user_id WHERE customers.user_id IS NULL AND u.ID > 1 AND u.ID NOT IN ( SELECT user_id FROM wp_usermeta WHERE meta_key = 'wp_capabilities' AND ( meta_value LIKE '%administrator%' OR meta_value LIKE '%editor%' OR meta_value LIKE '%author%' OR meta_value LIKE '%shop_manager%' ) ) ) AS temp );
Full answer by Dilanka Fernando: https://stackoverflow.stackexchange.com/a/79926745 (CC BY-SA 4.0).
Need it done for your business? UphillTech.