Verifying account creation isn't sustainable, it's what I did for several years but now there is just too much volume. I just double checked the numbers, for the month of July alone I got 982 registration mail alerts. I'm not reading them. These are only the ones that manage to pass the captcha. About half of them go to a special honey pot page I set up but the rest is still too much. So we need to wait until they make their first move and reveal themselves.
The frustrating part is that the bots continue to attack even if it doesn't work. The website must be in spammers database somewhere and they just don't care if their attempts fail.
Some of the bots are also never posting but use the report button on random posts and put a link in the "reason" field, that doesn't make any sense, only a forum admin/mod can read this… I hope they don't start to do this more often.