For me, what works is to stop the spam BEFORE reaching my blog posts and/or wpForo topics.
At Registation. I use The Shield plugin and that does all the job. Keeps most bots away (no registation or login).
Of cource it also protects me from other risks.
I can attest to this. @massimod recommended this same plugin to me whilst I was working through some issues with site headers. Whilst I didn't use it for the site headers, I certainly use it to stop spamming and fake registrations.
This is a problem of all websites, this is not wpForo problem. You should care about your website protection with special solutions.
First is provided by wpForo, it's the Google reCAPTCHA. Have you configured it in Dashboard > Forums > Tools > Antispam admin page? Do you see the reCAPTCHA on your registration form? Have you enabled it for all registration forms?
Second is the Akismet. wpForo is well integrated with WordPress #1 antispam protection system. Please activate it too, there is even free activation for this plugin.
Third, make sure you don't have other unprotected registration form from other plugins. Some profile, eCommerce, membership and other plugins come with own registration form. Make sure those are disabled or protected.
And yes, use Antispam plugins, there are tons of them, however after installation, logout and do some test registration, make sure they don't conflict with wpForo and user registration works good, test all from registration > email confirmation to login...