First, “Active last month” refers to users who have posted a comment in the last month. Every site like this has a large number of lurkers. A good rule of thumb is 10% of subscribers/users actually post/comment/participate. So 350-400k “legitimate” users sounds like the right ballpark.
Second, the numbers are so high because there has been a known bot attack. A few instances didn’t have email verification/captchas enabled so it was very easy to sign up for accounts very quickly. Some instances went from 500-800 users, to 10,000 users overnight.