A vandalism-only account is a single-purpose registered account that is used only to vandalize Wikipedia.
Most vandalism on Wikipedia is done by anonymous users. Such edits can be identified by the IP address in the page history. Repeated vandalism can eventually lead to being blocked. Administrators use WHOIS and geolocation to track vandals and perform range blocks. Generally, schools and other problematic organizations are blocked for a longer period (see § IP addresses).
As the IP address of a registered editor is not visible in edit histories, many vandals create an account and vandalize Wikipedia. This can allow editing via an IP address or range that has been blocked to anonymous users.
Vandals may also create accounts to vandalize Wikipedia in ways that cannot be done by unregistered users, such as on protected pages or by page-move vandalism. This is one reason for requiring that an account be autoconfirmed to perform these edits. While page protection is one method of mitigation, such vandalism still occurs from new accounts, resulting in the general consensus that they should be blocked as soon as possible (see below).
If you notice any suspicious edits from a user (particularly one who has only recently registered), the account is possibly intended to be used only for vandalism. A user talk page might not have been created (i.e. appears as a red link), may consist of warning messages only, or be blanked by the vandal. Usernames of disruptive accounts[1] also tend to violate Wikipedia's username policy.
Should you notice such activity from registered users, revert the edit(s) if not already done, and check the user's contributions to verify whether the other edits are vandalism. If so, the account can be reported to Administrator intervention against vandalism as a "vandalism-only account".