Well, not so lucky solution since profiles of those who post are still visible to the guests and it is still very easy to acquire the list of members and get all the public visible data, even if members.php is moved, belive me. Effect is just - nothing (ok, not absolutely nothing - we will kick out the kids that are new in the job), if it was a goal. Was it?
But, hmmmmm... disabling a bot to send PM by hiding the memberlist?
What one can do is disabling of PM service to the members that are not by some way approved or/and putting the word or/and link filter in PM service.