The board I'm an admin on has been relatively spam free for a while, knock on wood. Not sure exactly why, but it is possible that we are SO low in the international web ratings thing that we are not worth the effort. I'm sure GRM is fairly high. But we used to get hit a lot. Steps we (me mostly) took were:
Not allow automatic sign ups, which means a human has to look at the email address/name and approve it. Yeah, sucks, but we were being flooded.
When a new person signs up, if I am at all suspicious, I run the email address and the IP through one of the web databases of known forum spammers. If they show up, I delete the account. No reject, no mark as spam, nothing, just drop them. I am suspicious of all free email accounts: gmail, hotmail, yahoo, etc., get lots of attention. I banned all .ru addresses as we were being swamped with spammers from those domains. If we lost legitimate potential members, I'm sorry, but the spam load was too great. I banned a few other eastern European countries too, if we were getting a lot of spam from those addresses. Obvious home email systems like roadrunner or bumfuqIowaDSLService, etc., I let through without too much suspicion. Oh, the online databases have automated interfaces, so you might consider that, but given that this is custom software, you'd have to get some custom programming added.
We have a challenge question. They have to answer it correctly or they can't register. The Captcha thing was next to useless. The challenge question is not hard if you're into mil-surp rifles, but if you're a Russian spam king, it would take 30 seconds of google-fu to figure out, obviously too much trouble. When the spammers get through the challenge question, I change it up slightly. I suspect they use a bot to look for the question and then push the answer. Change up the question slightly and the bot can't figure it out. Like: "How many rounds does a M1 Garand clip hold?" Change that to "A M1 Garand clip holds how many rounds?" and the bots won't run. If they still push through the slight change, then I change it up to something totally different. Incidentally, that was a weak challenge question, as they just pushed 1,2,3,4,5,6,7,8 BINGO to answer it. "What caliber is a classic 1911?" was much better.
The last spam we had was from an account that registered six months ago. I suspect there are a few trojan accounts in there yet, but I'll whack them as they show up.