I recently posted about this on my site, that I didn't even use email verification, no captcha and other anti spam tools until we got our first spam post and more than a handful of members. I only require email verification at this point and we review posts as they come in. If it increases we will obviously increase the tools as well. But I want it to be as end-user friendly as possible.
I have installed Xenutilities addon and have API for all 3 anti-spam services. Since we installed couple days ago, it prevents about a dozen known spammer accounts. We only had 1 who got through and spam profile pages which we have to use the spam removal tool to get rid of.
i think xf is still flying under the radar. i dont believe the automated bots are programmed to target it yet.
the real test will come once xf picks up in popularity and catches the eye of the spammers.