Because they have a username thats why
Simply put hardcoded in photopost.php usergroup 3 is the unregistered placeholder. You have renamed this group to something else and allowed it to upload. Until you correct this unregistered users will be allowed to upload.
Do you understand that you can not alter the base usergroup without adverse affects?
This is what a standalone install looks like
Code:
Content visible to verified customers only.