Thank you to the person that tidied up

The CAPTCHA doesn't do anything to prevent attack runs like this. We have two CAPTCHAs. One as you sign up for an account using the standard ReCAPTCHA setup. And one that will show up as you comment if you trigger a heuristic filter or your IP was used for spam previously. The second one doesn't protect against forum posts, only comments at present.

These spammers pay folks in 3rd world countries to solve CAPTCHAs anyway. These current runs are closer to a denial of service attack than a typical spam run. They're advertising Korean scam sites which look like gambling sites but just steal your money and personal information. They use a huge botnet running on tens or hundreds of thousands of machines/IPs. I've blocked 1,600 of them so far.