Not to discredit your efforts, but I do wonder if this is because the checkbox is at the bottom of the registration field.
Usually, the checkboxes below the password are "I agree to the terms and conditions" and "I've read the privacy statement", neither of which anyone ever does, but everyone checks the boxes anyway because that's what's required to sign up for most websites. I've found myself automatically checking those boxes recently, because many of these newsletter "opt-ins" are required fields (which probably violates some kind of digital law but who's going to enforce this stuff anyway).
I wonder what your statistics would look like if instead your login form would show a new, ignorable screen with two buttons (inform me about updates over email vs don't inform me about updates over email or similar). I think you'd see lower percentages of sign ups, but probably better engagement numbers.
This might benefit your business in another way as well, because people have the annoying tendency not to understand what the term "spam" really means, and click "report as spam" on any email or newsletter they don't recognise (even after explicitly signing up for them weeks before). This causes your messages to get reported, which is terrible for your domain's email reputation, and your customers might even to get annoyed that you're "still" sending them email. Gmail added a "report as spam and unsubscribe from list" popup, probably especially for this reason.