Unfortunately, spam bots are no longer spam bots. It has gotten to the point where people will work for dollars a day to sign up and post pump and dump messages via forums. The CAPTCHA isn't very effective anymore, or, I should say, I don't have any information to really tell me if it is effective or not. It has the appearance of not being effective, though it could be. Same with the e-mail activation. Its no longer very effective due to its beyond easy to create hundreds of e-mail accounts or the free e-mails (hotmail and gmail are the most common ones it seems). I tend to delete the account and put the e-mail address in the blocked list. The reason I delete the account is because the account itself is spam, with the URLs entered in most all the fields. I suspect the reasoning is the more URLs back to the site then it will get indexed higher in search engines. I also tend to put the IP address used in the block list also, though I know most of the IP address are probably proxies or zombies. This is why I'd like to see the lists sorted, its much easier to manage when its in some logical order instead of the order that it was placed. Something to keep in mind with the v10 development. Especially that blogs are being worked into WebWiz, that is opening a pandoras box of spam issues. I think I most definately will start with the 'Post Approval for new user group' method.
May I suggest that in the v10 development, there are some additions to the administration. Such as, some sort of log file viewable from the Administrator menu of logins, both successful and failed, New user signups with corresponding IP addresses. We can make quicker and more informed decisions with this information.
Thanks for your time and ear Bruce.