Drupal 7 Site: Targeted for spam
One module you can make use of in this situation is the honeypot module. The Honeypot method basically inserts a hidden form field to Drupal (or other). End users don't see the field, so they don't fill it out. But spam bots (usually using prewritten scripts) do see the field, and always fill it. The Honeypot module detects this and blocks the form submission if there's something in the field.

EXTRA OPTIONS YOU COULD ADD

Another Simple thing you can do according to this site is hooking into the Drupal user registration process and using a php snippet like this:

flood_register_event('reg');
if (!flood_is_allowed('reg', 4)) {
header ('HTTP/1.1 403 Forbidden');
die();
}


Using the flood_register_event() method to register a possible flood event. The method records every registration when used in this context. Next, using the flood_is_allowed() check if the current user has triggered the flood register event more than 4 or XX times. If the user has tried to access the form 4 times they get another lovely 403 and all output is killed. You could use this logic either when rendering the Drupal registration page or upon every new submission.