I use modsecurity on my Drupal forum.

At the moment it stops pretty much everything that gets thrown at it, and the rest is stopped with Bad Behaviour and Mollom.

Legit posts still turn up no worries. All the crap just falls away.

I also have fail2ban rules in, so those that trigger modsecurity too many times get added and iptabled. Helps cut down on the repeat attempts.

I don't think it's hard to block spam. I do agree it's time consuming though, keeping everything up to date.

To be fair, though, SimpleMachines is a very atrocious piece of software (not to mention their equally atrocious licensing, although it seems they're in the process of changing that[0]...), so it's no wonder.

I could say similar things about phpBB, but that's quite a dead horse to beat (hey, at least they use a proper license).

[0] http://www.simplemachines.org/about/opensource.php

If you see Mechanical Turk used for spam like that, you could report it to Amazon as abuse and get the account(s) paying for it shut down.

I also wonder if Amazon has a content filter, to block URL patterns in Turk tasks.

As for bots, IP banning goes a long way.

Not if they really want your site. A place I used to work for was massively targeted by them, and literally the head IT guy gave up banning because they just rented new servers and continued the same stuff.

Essentially, like Jesus and the poor, spam we will always have with us (as long as there's an incentive).