Okay, I found an alternate solution. I'm using the autoconfirmed feature. Users are now autconfirmed after 24 hours. Prior to that, accounts have the same lack of permissions as anonymous users. After that, accounts have the normal user permissions.
So spammers will have to wait a day to spam. If that doesn't work well enough, I can increase it to a week.