For several years now I have been using email and Admin validation. I have a mod that allows me to quickly look at Google and StopForumSpam links for the username, email address, and IP address for pending members on the main index of the forum (only visible to admins, of course), so I don't have to go into the ACP. And I have a link to WhatIsMyIPAddress.com with the IP address, which makes it easier to identify people coming in through VPNs and proxies, plus I can see what country the user is coming in from. With these tools, I can identify most spammers 95% of the time (if not higher).
For spammers who who get through my manual validation, the first three posts a user makes need to be manually approved, so that will generally catch the remainder.
It's a pain, but it's the only reliable means I've had of keeping spammers off the forum.