[antialiasis]

Well, such a thing would always be easy to bypass unless one went into some major IP-checking - you can lock people out of logging in because you can block logins for the account, but for registrations, there is no foolproof way of knowing whether two registration attempts are being performed by the same user; you can of course plant a cookie, but few things are easier than deleting cookies, and then all that would be left would be using some sort of careful tracking of the IPs of registration attempts, which I think would just be a major headache to code for very little benefit - especially if you have multiple questions, a script that attempts random letter combinations in hopes of getting the right answer by chance would just take way too long for such an awfully small benefit - spam registration at one forum - that they wouldn't bother making such a script and instead just let the bot turn to some other victim that doesn't have this hack installed. In the spam industry it's all about posting as many advertisements in as little time as possible in as cheap a way as possible. Making things very difficult for them, as this hack does, will simply mean they will turn somewhere else; they have absolutely no motivation to attack your forum rather than that neighbour forum that's much easier to attack, and as such they're going to attack the other one because it takes less time and thus maximizes the profits per day.

For short, I think your board is quite safe from spam even if the bots get an infinite number of attempts.