After a 5 year hiatus I came back to SMF.
I noticed that you are still using outdated visual verification.
Set to medium I am getting 20 to 50 false accounts a week.
If I set it to extreme I get around 10 false accounts a week.
Also when set to extreme, some of my friends can't read the captcha, but the bots can!
I did notice that you have an Akismet plugin. This is great for stopping new topic spam but does not stop reply spam.
I would think that with all the thought that went into SMF, security would be a priority?