Ah - over the summer we got a huge influx of spam accounts. They still happen on a nearly bi-weekly occurrence, but back in June we hit the lottery one day.
So, I changed the user registration captcha questions and have changed them once again after that.
I also received an email from one want-to-be user in the past 6 months who wanted to join but didn't know the answer to his question. So there's a tricky balance...