Members who've joined but not visited

What kind of authentication are you using?  Is it possible they where added through Administration > Membership > Add Member?

No, they would have created their username and password on the user registration page. These are not users we created manually.

Do you require user approval before they can sign in?

Activation required I mean

No, we have members complete a survey via our system that performs the verification and the only way they can create a username and password is by completing that survey. Creating the username/password should log them into the site...

Sounds like you have customized the process, in that case I would evaluate your customization.  Chances are the account is being created and abandoned somehow.  Unfortunately evaluating customizations such as this would go beyond standard trouble shooting unless you see this behavior without it.

So, you've never seen this behavior when an individual creates a username and password on the registration page?

When standard registration occurs the user is logged in and redirected into the community so it is unlikely.  However as pointed out above there are other ways to create accounts with no visits, and no systematic way to know how a user is created, meaning there is no way to know if a user registered, was created via REST or via administration.

Alternatively it is logical in an approval required scenario a user could register but not be allowed to sign in until approved.  Once approved, the account exists but the user may never return.  So there are standard scenarios in an OOTB site where it is plausible.

When standard registration occurs the user is logged in and redirected into the community so it is unlikely.  However as pointed out above there are other ways to create accounts with no visits, and no systematic way to know how a user is created, meaning there is no way to know if a user registered, was created via REST or via administration.

Alternatively it is logical in an approval required scenario a user could register but not be allowed to sign in until approved.  Once approved, the account exists but the user may never return.  So there are standard scenarios in an OOTB site where it is plausible.