I’ve never worked on drupal but if you have the ability to write custom modules/checks, a simple check on user account sign up date works well. After a month or so they probably aren’t spammers.