First I'd recommend having both EMail Verification and enforcing one email per user.
"EMail Verification" and "Require A Unique Email Per Account" can be enabled from Users -> Registration -> Basic Options
We have a built in CAPTCHA which displays random characters that a user must enter correctly to proceed. We have both a self hosted GD or ImageMagick display, or one can opt to utilize
Google's reCAPTCHA.
CAPTCHA can be enabled from Display -> General -> CAPTCHA Settings
We also have the option of utilizing the
Stop Forum Spam service, including utilizing an API key to report spammers back to the database.
Stop Forum Spam can be enabled from Master Settings -> Primary -> Stop Forum Spam