Regarding the removal of unactivated accounts via the Admin Dashboard, I’ve observed as least some of the offending users were not removed as they were activated as shown here:
This seems to suggest the bots may now be following email activation links. And while I understand reCAPTCHA was added with the 1.6.0 release I have expressed some of my concerns on using it.