It sounds like you already know the dangers of agreeing to do spec work, and especially if you agree to it, that you still have them sign an agreement. But live and learn, you may change your mind on the next one. 
However, at this point, there are still a few things you can do to (try to) protect yourself. I say try because there is no guarantee that they won’t take the designs and find someone else to create them. You can surely make it more difficult for them to steal them and protect yourself if you want to pursue legal action against them if they do try.
First, since you didn’t have them sign an agreement up front, that doesn’t mean you can’t have them sign something before sending the files. Once you have the 3 ready, I would send them a basic agreement stating that the comps are ready and that they are your property until a formal agreement and payment is made for them. Any use would result in legal action. (obviously work up some legal jargon with an appropriate lawyer, I am not one). 
Only after they sign and send/fax you back the agreement will you send over the comps. If they balk at that, I would say it’s a red flag and would walk away.
If they do sign it, you can also protect yourself when sending the comps over for them to look at.
The first method would be adding a watermark over the design itself. This could be a faded overlay of your logo over important areas of the design (navigation, header design, etc) or simply the terms “comp only” faded over a few spots. This will prevent them from taking the image and slicing up portions too easily.
Another method, if you do not want to put a watermark over it, would be to send the comps over at a reduced size. While it’s best to show the client a version at full size, if they are just comps and not part of a paying client I would not be so concerned with this standard. Instead, send them the comp at 2/3 the actual size. This would still allow them to get a feel for what the overall design could look like, but obviously would not be large enough to slice and utilize on a live site.
Obviously, after you provide them with the files, keep an eye on their website (especially if they decline your work and say they are going with someone else). If you do notice a design based on one of yours, you can also file a DMCA to try to get the site taken down. Just keep all the original PSD files with the creation date timestamp. That may help, otherwise you can take them to court too … but that wouldn’t be optimal.
Hopefully it works out, but I would be careful with these types of projects … they usually are more work than they’re worth. Either way, good luck!