andrea_r, no I didn't know about hashcash, but when I looked it up it seems to be for comment spam not signup spam.
Klark0, thanks for the info about comments being affected with hashcash.
so far I've tried changing my captcha to recaptcha, but really the only thing that stopped bad signups was testing buddypress with extra profile fields. Unfortunately, my webhost suspended me for too many mysql calls soon after that so I removed it and promised to reduce mysql queries to get my sites back, so buddypress is out until I can afford a dedicated server.
I'll going to look for a MU plugin just for extra required profile fields on signup. I thought I saw something for that.