I'm keen to minimise the impact on legitimate new (or existing) users
I wasn't talking about gagging new users, I just wanted to point out that with an update of YaBB to 2.2.3 it is possible to prevent this:
10: user applies for new account
20: current YaBB automatically accepts that
30: user clicks on a link in the email
40: voila: valid account
50: SPAM SPAM SPAM
60: goto 10
if admins must confirm creation on new forum accounts, this process can be slowed down a lot.
I bet I could create accounts faster than any admin can delete them right now...
all I'm saying is that currently this forum is WIDE OPEN for spammers.