I used to run a forum for an indie videogame with a small but passionate userbase. Unfortunately it was completely overrun by spambots to the point that moderators couldn't keep up and they drowned out the real posts. We had to shut it down.

This is one of the reasons Begg Knives shut down his forums. We literally couldn't delete accounts fast enough.

When I used to manage web forums, I ask a hard question during signup and put the answer within the question itself (e.g. "hint: the answer is xxx").

This usually stops simple spam bots that are aimed at that particular off-the-shelf forum software.

Why not stop allowing registration except by manual whitelist? At least until the spammer lost interest.

Is that less friction than captchas?

How would that work?

Manually approve someone who registers ... then discover they're a spam bot?

Anything with a chat/comments section will be overrun with spam-bots and be rendered unusable and unwelcoming. The difference between a bot-ridden comments section in a blog and a clean one is huge.

There are lists of companies with workflows like this that get used in spam campaigns. You can put any email address in and now they will get a signup notice and multiple 'hey you didnt complete our workflow!' marketing messages. Easy way to put a lot of useless messages that mostly pass spam checks in any mailbox you desire.

I recently had an incident with Chime Bank like this, where someone enrolled every public email address at my company with them. I sent them an abuse report and they told us to block their domains. Real great solution, guys.

True that! Had a discussion along that line just earlier today about the contact us function on my website. Worst case, I get some more mails in my spam folder. I can live with that, checking it every two weeks or so doesn't hurt.