In addition to what @Gisle Hannemyr said, I would recommend spamicidethe spamicide module (sets hidden field that if it is filled by a bot on registration, it will not create the account) and the re-captchare-captcha module on your registration forms.