Good thing to do is make sure that guests cannot view profiles or the userlist. That's the incentive they are looking for, hoping search engines crawl their profile to harvest the link to their site. They aren't clueing into the nofollow, but I think they'll catch on that search engines can't view their profile at all, so it's a waste of time.
