If you setup the very basics of security on XF you will likely not have many problems.
ANY software not properly locked down will immediately attract spammers - by the thousands!
While you are developing your forum, turn registration off - or to manual approval. Use the QA function of the registration captcha. Use the timer set at 20 seconds or so. Use the other tools built into the registration options.
At that point you will have very few spammers. I have almost none getting through.
The spammers are smart. ONce they register they make their account dormant, after 2 months they create their profile link and make a post after some. Once they post their link. They create tonnes of backlnks. Now i have tonnes of backlinks for non existant pages. My question is only about google. will it consider my site spam site or penalize or blacklist.