My approach thus far has been to minimize spam but to keep it open for new users. It sucks with spam attacks though, especially if your client doesn’t allow you to filter spam.