Dave, I agree with you, but I think that the solution isn't going to come from a CVS release from phpBB.com, it's going to have to be people like us who modify our boards individually that make the difference.
My comments on the subject shouldn't be a mystery, I've commented in the forums here on them enough, but here they are again:
1) phpBB VC out-of-the box is no longer an effective deterrent to spam. I went to the FEECAP VC Mod
four weeks ago and have had no, none, zero spam registrations or posts since (I have Guest posting turned on with the VC for Guests mod
installed). phpBB isn't going to issue these difficult VC images in a release because of the problems associated with disabled users.
2) Espicom's 'agree' mod was a clever bit of code, but it is a short-term fix, one that loses effectiveness each and every time it gets mentioned here, and/or installed on a live board. You may be absolutely sure that the botters have taken note of it and are writing code to defeat it easily (the 'agree' text, or it's substitute are displayed in the code of the COPPA page, so there's no way to hide it completely).
3) Hiding unactivated/zero post members is a way to completely defeat the botter's intentions for registering, but until the majority of boards are doing this, the spam will continue "shotgun style" on the chance that a significant percentage of the spam registrations show up in live boards that still show new registrants in the memberlist without activation.
4) Admin approval is always going to be slow and annoying for registrants, with or without a section for any essay about why they are registering. Some people will register for the slightest reason, and never post. I get genuine registrations all the time, which from all apperances are from people who are interested in the subject of my forums, who never do post, and eventually get deleted after two months. I think that part of administering a board is the manual removal of deadwood users. If for no other reason than to make sure that the PM feature isn't being abused in some manner. (User never posted? No matter, PM still works, what if some illegal activity was being coordinated using your board's PM functions? [insert freaking out smilie here])
5) Your proposal for an admin "instant ban" button is interesting, but in the end, why bloat the database with usernames, email addys, and IP addresses that are like tissues, disposable one-time use? Provide an admin Memberlist with the "delete user and posts" button with a confirmation (Are You Sure?) before dropping the info from the database and you should be good to go. Once again, it's the admin's responsibility to keep the board cleaned up.
6) Doing the admin's duty would be less of an effort without the larger amounts of spam to deal with. Until someone comes up with an alternative to VC, a better, more difficult VC image, combined with unique mods to the regular phpBB releases is going to be the best we can do.
7) Severe punishments for spamming. This could be the subject of an entirely new category of forums here: "Crime and punishments, post your favorite spammer torture techniques here". Maybe having paid bounty hunters to bring spammers to justice?
8) Get used to it. The evidence provided by email spam is that it isn't going to stop anytime soon. Maybe someone will get clever and write a "Spamassassin" program mod for phpBB ??