I suppose that's a yes, then :)
I'm going to set it to user activation. Also, it's friendlier to real users, since they can have their accounts up and running fast.

The best way to detect possible spammers is through their emails. They usually have strange domains (from east europe countries, mostly, .ru (Russia) , .ua (Ucrania) or .pl (Poland) ) and names like "jfufsife" or some gibberish like that. Inf one manages to get through, we'd delete the accound and set the ip or domain in the banning system.