How are they finding it?
A while ago when running a test hub to develop scripts, I noticed the NMDC hub doesn't always respect your wishes of "not auto-registering". It sends a registration string out there anyway, shortly after the hub started. You can see it in the status window, it's probably going to be the first message appearing there, after you started serving.
I'm not sure if it continues doing it after that "startup registration", but it always sends at least one reg string.
Aside from that "I'm going to tell Hess there's a new hub in town" attitude of the nmdc hub, you have plenty of other reasons why you might get users. The "Jorge Bot" for example runs along with a port scanner/tester, and will add you to his list of hubs, if you have 411 opened when it tests you (crazy the programs you can run when you have an university's bandwidth all yours over the week-end).
If you really want your hub to be private, you need to "allow only registered users" (which you are probably already doing, since you mentioned some $ValidateNick from the status window, and not actual unwanted users in your hub).
The only way to make things more efficient is -
assuming than you setup the hub only to be used by you and your 2 friends- to have a script ban "." when a new user connects and the total number of users is 3 =)
That way, the connection requests for everyone else will be rejected much earlier than the $validatenick and should save you some bandwidth (don't forget to add a little timer to check every now and there if there's still 3 users, or if the dot ban should be removed)