Any forum that lets people register and post will be found by spambots, usually within days. The phpBB team says it plainly in its install guide: the attacks are generally not personal, spammers are just looking for accessible targets, and admins should set up anti-spam measures right after installing (phpBB 3.3 docs/INSTALL.html, "Anti-Spam Measures").

At registration

  • Use a question-and-answer CAPTCHA about your topic. Bots that beat image CAPTCHAs often fail niche questions.
  • Require email activation, or admin approval while the forum is small.
  • Limit registration attempts per session.

For new members

  • Put new accounts in a "newly registered" group whose first few posts need approval.
  • Block links and signatures until a member has a few approved posts.
  • Don't let brand-new accounts send private messages.

Ongoing

  • Keep software and extensions updated; old versions are easy targets.
  • Check the approval queue daily, and ban plus delete in one step.
  • Watch for "sleeper" accounts that register, wait, then edit old posts to add links.
  • Back up the database before bulk-deleting spam.

Don't

  • Leave registration fully open "just for launch."
  • Rely on one measure. Layers work best.

More forum admin guides (moderation, SEO basics, backups): https://4freeforums.com/

I help run 4FreeForums.com.