It seems like every couple of months, spammers come up with a new angle of attack.
I've changed the "Users Awaiting Moderation" group so they should only be able to send 1 private message (sometimes people PM me if I forget to enable their account so I want to leave the option open for now.)
I fully expect that nothing I do is going to hold up for long since they should be able to hide their IP addresses already and soon they'll be able to use AI to generate user names and posts that seem authentic. Spammers have developed a lot of new techniques for Facebook and Twitter, but bulletin boards are a little harder and much less rewarding. But AI is cheap so the benefit can be very small and still be worthwhile.
I mean, they probably already have database of all the vbulletin sites in the world and they can run their programs to go after as many of them as they want to probe to see what works.