Yeah, same pattern here. It’s usually not “clever” spam, just a burst until the weak spot gets annoying enough to fix. I’d leave signup alone unless it’s obviously the hole. First-post moderation or a short delay usually helps more without pissing off legit users.
