The install of phpBB we're using here is completely stock, aside from some tweaks to the templates. We're using reCAPTCHA on the registration page (which is an option as of 3.0.6, but there is a modification for 2.0.x that adds it) which seems to keep a lot of spammers at bay. We do get the occasional account posting spam, but their accounts tend to get deleted pretty quickly. We also do a bi-monthly (ish) purge of all zero-posting accounts to help rid the spam-sleeper accounts. That is probably worth doing, though there's not an ACP tool to do it with 2.0.x. You can run a SQL query to do it easily enough, if you're in to that sort of thing.

I'm not really sure why we've escaped the blight of PM spam. Honestly, I can't remember ever having a case of it reported. It could just be blind luck, I guess [)] ]'>