I run the BDGA forum, and we had the same problems.
Personally I use User authentication, as 80% use fake email addresses, I didn't want to be bombarded with authentication requests. Then I clear out the dead ones each morning. Agree with other people that banning as many domains as possible helps, so *@*.ru etc.
But what really nailed it was these two...
Luckily, one of my buddies is happy messing around in code, so added these and bob's your uncle
Still get occasionals, maybe one a day or so.