What is the best way to handle spam on pages like user registration or password recovery? I am not asking about whether to
lockout a user for a few minutes or how to put up a
captcha. I'm interested to learn on how do I target the spammers.
Iv'e read that it is bad to target a user via:
IPsince a lot of users share a common IP (e.g. users connected to the same wifi, users on a proxy, etc.)
Cookiessince users can just close open browsers and not allow cookies
So how do I target them so that I can implement proper spam prevention systems? I think it would be very easy for a spammer to just use the password recovery or registration form to spam away my site's confirmation emails, which would result to users flagging the emails as spam and stacking the server with unnecessary requests. Any ideas?