I have run my forum for 20 years. It started allowing guest posting, but that when away after a coupe of years when spammers started showing up in large numbers. From then it has been a battle against the spam bots and I have finally hit upon a combination that works well. I get maybe one or two post attempts a week and simply delete the accounts. I'm sure there are other combinations of things that would also work as well, but I'm not really interested in spending a large amount of time trying to figure out what those may be. You have a vested interest in this since you charge people to set up spam protections.
I'm also reluctant to upgrade phpbb again and have to take massive amounts of time to get to where my site is now. I didn't upgrade to phpbb 3 at all until early this year when a developer I used did it because of an issue with phpbb 2. The forum I run is populated by mostly grumpy old men who had any kind of change. Several years ago I changed the graphics in the header image (nothing else) and within a half hour had overwhelming complaints about the changes and how hard the site was to use! In time everything would calm down, but changing the appearance just to have the version be updated is not a compromise I want to take and having to redo the theme to make it match exactly is expensive.
I'll take my chances and stay where I'm at. I don't expect to have issues, but if I do, I have back-ups from an hour ago to several months.