Tim,
I've beaten the spammers by setting "Admin Approval" for new members. The spammers are easy to recognize - their email addies are garbage and when they bother with a domain name, so is that. I literally delete a dozen registrations awaiting approval each day before the spammers can even get to the point of posting. Here's a screenshot of the relevant panel in SMF.

I tried that, but with that turned on, they can't update their registration, so nothing wonky shows. You can only activate them, and then they update and post spam anyway. You can spot some of the email addresses, but not all.

I'll repeat it again for those who missed it.

If you get spam in your PM's, let me know immediately.

There is a class of spammer who looks innocent on their profile, never poss in public, but are here to post PM spam.

Tell me about them and they'll be history.

Hope you fix the issue. I just came in to catch up and had another spam thing. Could see no way to report it.

PM spam?

Copy it to me and tell me who sent it. I'll nuke them.

If someone is registering, they sold be willing to make at least one post to keep the registration. Why not edit the welcome message or success message to say that if there isn't at least one post within a day the registration will be deleted?

There are a lot of members who login to read, but have never posted.

Forcing them to post something isn't my first choice.

And besides, once spammers figure it out, they'll post something innocuous to start with, leave it a while, then post spam.

Ideally I'd like all new registrations to be on pre-moderation automatically, but I can't figure out how to do that. That way first posts would always only be seen by me until I okayed them. Might frustrate a few people who post just after I go to bed, and have to wait before they appear, but it wold keep the spam out.

Just as an update, I had to undo a couple of IP bans due to inadvertently blocking a member. I was afraid of that, but sometimes you have to try.

In the last week I've been seeing an uptick in the number of seemingly legit registrations, but with email addresses which set off my alarm bells.

A lot of these sit dormant for months, and then finally post porn or advertising.

Until they update their profiles with something I can action, there is little I can do.

However, I am doing more pre-emptive pre-moderation on registrations which set off an alarm, so if by any chance you are a legit registration and find your posts have to be moderated before going live, this is why. Legit posts will go live as soon as I see them, and the restriction removed.

The other thing I've done is slowed down the posting rate. Previously a spammer could register and post 23 times before I got the notification and removed them. Now, they can only do 1 post in the same time. The bots won't notice that 22 of the posts failed. But we will notice the 23 posts of crap have stopped.

I keep reviewing periodically.