@Gargron do what WTDWTF does
there's no secret magic to it
users require a published post to edit their profile
users with zero or negative upvotes require mod approval to post
registering an account from an IP that is already associated with an account requires admin approval
about a month into this policy the spammers completely gave up