It seems that no matter what I try, some spam bot somewhere will always find a way in.
I thought about deleting them, but I read that it's better to just leave the account on the server and block it, because that way the email address is still in the database and can't be used to sign up another account.
At the moment, I have around 1,000 (or more) user accounts in my database that are spammers I have blocked. What I'm wondering is how many of these addresses can be held in the database before it starts to bog the system down. Does anyone have any experience with this?