This was ultimately the downfall. The “prove you are human” test was only one of several safeguards we had in place (recaptcha v2, ip blocks, akismet, honeypot “fake” fields only bots would see and fill out), but the reality is, over the last 18 months or so it apparently became cost-effective to have humans fill out your spam. At that point there was no remedy, and it’s going to become a huge issue. So much spam protection is predicated on the idea that bots are sending it, but that’s no longer the case for comment form spam. Additionally, PR firms found the form and used it relentlessly to hawk every product/service/media you can imagine, also from disposable addresses. The huge red “THIS IS NOT FOR COMMERCIAL SOLICITATION” notices did nothing. Such abhorrent behaviour.
You can imagine as an Author waking to hundreds of hand-written spam or solicitation emails sent overnight and fishing through to find the maybe one or two legitimate submissions - every day - would become overwhelming.
The same thing has been happening here on the BBS as well. I spend at least a third of my time deleting spam accounts now, there are as many as 50 new accounts a day here despite all the tools Discourse has at its’ disposal. All from different IPs (from different countries) and with unique email addresses. Akismet helps some, but human spammers learn what not to say to trigger the filters.
There were quite a few, even from BBS regulars. It’s unfortunate that they were drowned out by bad apples. 
