POW will obliterate spam. The key is to make all requests require it just a little bit, not just signup. Combined with IP rate limiting it will be impenetrable.