Additionally, I need to alter the response spam registrations receive so they don't think that their registration has failed and that we don't prompt them to alter their codebase to handle any changes we've made for it.
That's a critical step, a huge mistake people running forums make about spammers is to think that they care, or that they are humans, people just can't grasp that these are pieces of software. I made this mistake when I discovered my first xrumor weak spot, and let them know I'd detected them, now I don't, ever.
Emails should be sent exactly as usual for confirmed user signups, including the click here confirm link, and when that link, which is itself clicked by the software, doesn't work, they don't really think further about it since it could be a delay, or a admin moderation queue, they have no idea.
Auto spam detection of bot user signups has to be very close to if not 100% or it won't work long term because of the vast numbers of attempts. Once your site signup url gets distributed on the forums database xrumor users buy and trade, you can forget anything less than 100% detection or you have to wake up every single day and remove 10 or more user signups, if say you hit 99%, plus their inane postings.
