I'm a little late to the game on the question, but since I mostly disagree with the other answers here so far, I'm presenting a new one.
The main things I disagree with from the other answers are:
Adding users to the DB is not the same thing as creating a honeypot. (It's probably possible to take a definition of honeypot and interpret it in such a way that this could be considered a honeypot, but I think it's a stretch.) Suppose you add 10 users just for your QA team to use for testing. If you notice that any of those users have logged in outside of normal testing hours, or from IPs that are not expected, you would be accomplishing the same thing, and surely you wouldn't call those QA users a honeypot.
Adding additional users to the system does not make the system more vulnerable. If that were true then every time a new user creates an account the system would become more vulnerable. That would be pretty sad if it were true!
As for whether adding users to the system would be helpful, the answer depends on what your application actually does. If your user database is compromised, which would the attacker rather have: the information contained in the database (such as usernames/passwords/email addresses) or would they rather have access to the website? Consider:
- If the site handles banking, then an attacker will likely try to login with many accounts and move money around or gather account information. (The "extra" users may have login attempts in this case.)
- If the site is just a free forum, the attacker will probably not care about logging in and will instead consider selling the email addresses, or try to brute force the password hashes to guess passwords on banking or e-commerce sites. (This might be the most likely scenario.)
- If the site has interesting paid content that the attacker wants, they might chose a single user and login with it. (Which is unlikely to be one of the "extra" users.)
So, in the first case, monitoring the "extra" users might be somewhat helpful, but in the majority of cases it probably wouldn't be.
That being said, if you still want to try it, perhaps the most effective approach is this:
- Create two new email accounts with very difficult to guess addresses, extremely difficult passwords, and then set them up to forward to your main email account that you check frequently.
- On your site, create a new user with each of those email addresses, both with very difficult to guess usernames.
- Give one of the users a very hard password, and give the other user an easy password.
Now you've accomplished two things: if either of those users ever logs in (likely it will be the one with the easy password), then your DB is probably compromised. Or, if you ever receive an email to one of those account's email addresses, your DB has likely been compromised, and the email addresses were probably sold.
Final thought: above where I mentioned the most likely scenario (the attacker attempts to gather user/email/passwords for use on other sites), in that case they may never login or sell/spam the email addresses, and if so, unfortunately it will be pretty difficult to detect this outside of monitoring all access to the DB server.