I started having the same problem about two months ago.  Until that point, my site only required an e-mail address, user name and password.  So, I changed the user account registration settings to require a first name, last name, country and CAPTCHA.  However, the SPAM registrations keep coming through with only the e-mail address, user name and password. 

My guess is that somebody has crafted a form which gets posted to my website, bypassing the client side validation, and registering users.  If my guess is right, there is no server side validation of the registration settings.  Enabling or creating server side validation would help this problem (and should be instituted anyway as a matter of best practices). 

I have temporarily disabled registration on my site, and will work through some of the suggestions on this forum, but I would love to hear if anybody knows if server side validation of user input is done by DNN.  Thanks.