From http://wordpress.org/support/topic/spam-users-in-wp_users-after-wpsc-upgrade/page/4?replies=174

fix-sample.php

<?php
// Remove users and meta data.
function fix_wpsc_clear_customer_meta() {
	global $wpdb;
	require_once( ABSPATH . 'wp-admin/includes/user.php' );
	$purge_count = 200;
	$sql = "
		SELECT user_id
		FROM {$wpdb->usermeta}
		WHERE
		meta_key = '_wpsc_last_active'
		AND meta_value < UNIX_TIMESTAMP() - " . WPSC_CUSTOMER_DATA_EXPIRATION . "
		LIMIT {$purge_count}
	";
	// Do this in batches of 200 to avoid memory issues when there are too many
	// anonymous users.
	@set_time_limit( 0 ); // no time limit
	do {
		$ids = $wpdb->get_col( $sql );
		$included_ids = array();
		foreach ( $ids as $id ) {
			$included_ids[$id] = $id;
		}
		$in = implode(',', $included_ids);
		$wpdb->query( "DELETE FROM $wpdb->users WHERE ID IN ($in)" );
		$wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id IN ($in)");
	} while ( count( $ids ) == $purge_count );
	// Update number of users.
	update_option( 'user_count', count_users()['total_users'] );
}

// Modify action hook for WP e-Commerce automated task.
function fix_reset_wpsc_cron() {
	remove_action( 'wpsc_hourly_cron_task', '_wpsc_clear_customer_meta' );
	add_action( 'wpsc_hourly_cron_task', 'fix_wpsc_clear_customer_meta' );
}

// Do reset.
add_action( 'wpsc_init', 'fix_reset_wpsc_cron' );