Currently, in protected function accountDetailsSaveProcess(\XF\Entity\User $visitor)
, you only spam check the "About" field.
I'd like to make a case for also running spam checks on the "Website" field, as every 2 days or so I run a query to check for users with potential spam (excluding customers and known good users) and find 3-6 spam links in there.
Due to the risk of false positives I concede it could be slightly more complex than just copying the "About" spam check code. If it was possible for users to be placed into the Approval Queue if the spam checker believed it was a spam link, that would be perfect. That way, legit users could be allowed through, and spam users could be deleted via the spam cleaner.