There are two phpBB configuration steps you can take without installing a MOD.
Enable account activation
When set to None, a user may log in as soon as he/she registers. When set to User, a user must validate his email address before logging in. The user will be sent an email with an activation link. When the user clicks this link, their account is activated and he/she may log in. When set to Admin, a user's account must be activated by an administrator.
Enable visual confirmation
When set to Yes, a user must enter a displayed code in order to register. When set to No, a user may register without any checks. If you are suffering from a large number of automated registrations, you may wish to enable this option to reduce them.
I should probably turn one or both of these on.
