Also make sure you sign up for Akismet and enter its API key in the XF Options. It's free, and blocks
way more spam than StopForumSpam (which is more a IP / email / username reputation checker than a content matcher, in my experience).
Lastly, I would recommend these two addons by
@Xon:
Contact Us Thread (allows XF's spam checker to work with Contact Us, and you don't have to use the actual thread posting feature for this to work)
Signup abuse detection and blocking (powerful tools that pre-catches a lot of accounts that would end up posting spam)
These three tools combined cut our spam down to almost zero. Since adding these three tools about 2 months ago, we have had one spam thread slip through. One. Compared to before, where we'd get 2-4 a week.
The only real spam we get are people who sign up, then edit their signatures / "About" fields with spam. To assist with removing this spam, I developed this tool:
DragonByte Spam Clean (adds new searchable fields, as well as an option to run Spam Clean, to the "Batch Update Users" tool in the AdminCP, and adds the ability to remove profile info when executing the spam cleaner)
The below is for advanced users only! Don't try this at home.
If you're comfortable editing the database, you can inspect people's profile info in the database, and run queries to set confirmed spammers' "Homepage URL" to something easily searchable like "iamaspammer" and then use DragonByte Spam Clean to search for this exact text, and batch spam clean all those fake members.
♫ Simple and clean is the way that no spammers are making me feeeeeel tonight, it's hard to leeeeet go ♫