.> That is correct - there are plenty of gateways in the portal that have no subnets attached to them, but they are filtered out of the encap list.
Ok, then apparently these "rogue gateways" (they happen to be all from Poland) are using some method to use the encap file to load tunnel interfaces and static routes.
I had expected them to use the script that Marius wrote for MikroTik, but in that case they would not receive the RIP broadcasts and so would not be able to build all those tunnels (and send MikroTik neighbor discovery on them).
I suspect there has been some "how to setup an AMPRnet gateway" doc going around in Poland... Tom SP2L is already looking at it.
Maybe you can just remove all gateways that have had no subnets for some time. Although that will likely not fix anything...
Rob