What version is this? And are you talking user drafts or fully created user object that are just not activated? In 4.1 user/register checks if you have a valid session before it will let you see the form (and hence creates the user draft), so most draft issues should be solved.
The version I'm using is 4.0.1 and the spam signups are fully created user accounts but not activated.
I haven't upgraded to 4.1.1 as yet, I might wait until 4.1.3 :)
A number of the sites I build arn't user driven so it's a shame there isn't just an option in the admin to switch off the registration form all together.