I now think it is more human than bot after reading the article at www.deathbycaptcha.com. The question actually is how does someone find so many message boards to spam?
The answer is you use the keyword C A P T C H A in a search engine and there are message boards galore! So the method of protection is actually the fatal flaw. How else could they find such a small community like Theremin World tucked away in Kansas with Dorothy and Todo?
The word itself or others common to message boards is a welcome mat! LOL
Purge the entire data base of that nasty word so you are not captured by 21st Century warfare.
Death by Captcha_ offers an outstanding low price of $1.39 for 1000 decoded CAPTCHA_.
I helped out a web forum a few years ago while it was under a very heavy spam attack.
A CAPTCHA or some other "test for human" is a first line of defence. It will discourage a good percentage of spammers, who typically go for the low hanging fruit. But some will persist and defeat the test one way or another.
I was authorised to delete blatant spam and associated accounts as soon as they appeared, and also to examine new accounts, looking for tell-tale signs, such as originating domains that had a history of spam accounts, and names that showed up in Google searches along with the word "forum" as having recently joined a lot of unrelated forums in different languages and flag them up to the forum owner to make a judgement call on.
One trick that I saw being used is to make an innocuous posting on an existing thread, and then revisit the thread much later when interest has been lost in it, and then edit the innocuous posting into a spam posting. (Spam postings are often not actually aimed at human readers - they are aimed at web search engines' page ranking algorithms, trying to push the websites they link to up to the top of the search results.)
To prevent this, I suggest limiting the period in which a posting can be edited to a week or so, to allow people good time to change their minds about a posting, but not to maliciously edit dead threads.
"Spam postings are often not actually aimed at human readers - they are aimed at web search engines' page ranking algorithms, trying to push the websites they link to up to the top of the search results" - GordonC
Facinating! - And yes, that does make a lot more sense.. Pushing a website up in the search results is worth a lot - actually translates into a lot of extra business / money, and represents a substantial percentage of expenditure (Search Engine Optimisation) in online marketing. My brother has a "small" on-line retail business, and employs 3 programmers full time, mostly doing SEO.
Perhaps the way to thwart this practice will require involvement of search engine providers (Google etc) - If they had a notification scheme where site operators could notify them of spamming, and they then downgraded (to a position where they appear last) the ranking of anyone found using spam to boost their ranking.
"Does he sell golf equipment?"
Go wash your mouth out with soap! (as my parents occassionally made me do when I said a word like damn or bloody! - I never even thought the F word! ;-)
No - In fact he is an upstanding member of the community (unlike me, LOL) - His retail business is http://www.partysuperstores.co.uk/ - it was burned to the ground in the London riots, which was tragic, as this business is the financial backbone of his charity http://www.streetkidsrescue.org/
The business has now revived, being hosted at Debenhams stores - But I will stop here lest I am accused of spamming! ;-)
And BTW, I can vouch personally that spamming does not form any part of his business (the link I have inserted above is a naughty, unsanctioned action for which I take full personal responsibility)- I occassionally reviewed the activities of his IT team in the early days - but I was not up to the job as the business expanded .. However, his hatred of spam is at least as strong as mine!
So, it sounds like we have our work cut out for us with the spammers. I'll keep looking for solutions, but I do appreciate everyone's patience as we find a way to deal with it.
As I find comment or forum spam, I'm deleting it and banning those user accounts.