CAPTCHAs don't really work anymore. Even the best of CAPTCHAs is broken by paying someone a quarter an hour to solve CAPTCHAs.
We have a system in place to block spam messages, and no spam was actually posted, they just managed to get past the registration step. We have a CAPTCHA along with a simple question and answer you have to answer to register, and it is asked every time you post or send a PM until you get 10 posts. Also new threads from users with less than 3 posts are automatically put into an approval queue.
Someone finally took a look at the site and answered the question and hardcoded a bot to spam registrations. This was mostly harmless, just annoying more than anything. I changed the question and added a few more and so far nothing since.