Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones. To stop fake signups, require confirming the

Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones. To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.