Forum bots are evolving and are easily getting through security questions and reCAPTCHA.
Introducing email verification is a good way to obviate spam bots from infiltrating the forum. Blocking suspicious or unfamiliar email domains is an additional good idea, as most spam accounts are unlikely to register with common email domains as they may not meet the security requisites upon registration (Gmail, Outlook, Yahoo, etc).