Well, that's a different question. If you have 500k spam registrations, then how do you actually know if they are spam? Deleting users that haven't confirmed their email will delete spammers and real users. Furthermore, it is not difficult at all to validate an email so spammers validate their emails too.
It would be much better to avoid getting 500k spam registrations in the first place :) Try this plugin https://github.com/KrzysztofKielce/q2a-captcha-antibot
and give me some feedback (take some statistics on the number of spam registrations before and after the plugin).
Anyway, I do agree with you on the fact that batch processing is necessary.