I'm using recaptcha on a very simple forum registration page. The script first of all checks if the recaptcha code is valid, then it process. As soon i did put the website live, it got lots of spam registrations (~30). I was very surprised that how the spam bots could bypass the reCaptcha.
Anyway, to make it more secure, I did implement the stopforumspam.com API. So, first the forum checks the reCaptcha, and then it checks the stopforumspam.com to see if the email is spam or not. However I'm still getting the spam registrations (with the emails which already exist in the stopforumspam database).
I tried to test my registration system by registering with a spam email that already exists in the stopforumspam.com database, and my system did not let me register.
So, now my question is that, is this weakness in my programming code? Or the spammers do not use the registration page, they some how inject the code in the database? Is it possible to check that? Is there coding practice to prevent this problem? Thanks.