Change your question. They obviously know the answer to the current one. It only needs them to guess 2 letters.
Even more complex questions need changing now and then.
On a side note, bots registering is not a security issue. They're doing what any normal user would do.
See How to clean up a board hit by spam
for some suggestions.