Oh yeah, the current question went through several iterations just to test if we were having automated spam or actual people spamming us. Turns out it's people.
When I saw recaptcha broken I suspected that
I'll look into more devious things later in the week, if I have more time.
Well, the hidden trick field may or not stop them, depending on the skill of the spammer.
Other solution would be to require approval of users. This is however very inconvenient.
However if we disable the incentive for them I guess they won't overcome the hidden trick field.
So hiding the signature in the user page is the first step to take. Otherwise they will have enough incentive to overcome whatever countermeasure we use. They know they can't post because we will delete their messages, but amule.org is a high-pagerank target.
Then, once they have no incentive, I can make a list of spam users so you can mass delete them. As a first approach I'd delete all the users with 0 posts and a given seniority.
Other question, why the spam subforum? IMHO you should delete all the posts there, they contain links.