vBulletin is proprietary and requires a $100 per year license. Of course, there are pirated copies floating around, and really, what are they going to do, threaten SR to take it down? A simpler solution is to require a Gmail address when registering. Then you hand the problem over to Google's very effective spammer blocking mechanisms. Obviously we can't do that, though. That has problems of its own, namely trust. That was the solution they tried a few months ago and apparently someone went rogue. BTW, to anyone who says they don't care about the spam, if you are a vendor, then all the money going to the spammer is money not going to you. The $1000 that somebody sent the spammer a few days ago is a pretty big sale that some vendor lost. This potentially affects you personally and financially, so you should care.