I've made a site where users can create accounts. Lots of spam accounts are being created and I am not sure why. The form at mysite.com/user is mollom CAPTCHA protected, what other paths should I check?
Mollom tests content for spam. But user creation form does not provide any opportunity to provide spam content in the first place. So you have 2 strategies available:
Protect user creation form with more traditional captcha, or one of it's mutations like reCaptcha or little game humanity test.
Protect comments / node forms with Mollom and automatically block users that will fail mollom test there.
Note, above ways are not mutually exclusive.
Well, in that case Spamicide Module is a gift to get rid of spam posts and spam accounts.
Spamicide adds an input field to each form then hides it with css, when spam bots fill in the field the form is discarded. The field, and matching .css file, are named in such a way as to not let on that it is a spam defeating device, and can be set by admins to almost anything they like(machine readable please). If logging is set, the log will show if and when a particular form has been compromised, and the admin can change the form's field name (and corresponding .css file) to something else.
Spambot module which makes use of stopforumspam.com's database of known spammers.
Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.
Checks (username, email, ip address) data against the www.stopforumspam.com blacklist. Blacklisting can be based on either of email, username or IP address (with configurable thresholds).
You could also make use of projecthoneypot.org
Project Honey Pot is an open source initiative to track abuse, fraud, and other malicious behavior that occurs online. The Project tracks more than a million IP addresses engaged in suspicious behavior each day and reports on them through our website.