There's both an image CAPTCHA and a Security Question, but both work. I believe it was just that it wasn't stopping some of the spammers, because they actually were humans who were getting token payments for spamming forums with links, something like that. There's nothing either can do about this, since they're designed just to stifle the robots. .
What actually doesn't work, I think, is IP's anti-spam service. I think a license is required for that, and ours is either expired or we never had one. This was disabled until I enabled it a year or more ago, so to my knowledge we've never been able to make use of it.
I think there are only so many actual people who are both willing to spam and find our forum of all the forums out there, so we've been combating these guys manually as AR detailed above. The CAPTCHAs probably do pretty good work in sorting out the robots. It helps that the security question is a little atypical, i.e, it's "Enter the date you see below, *except* for the last digit: 3-15-2009" or something like that.