We had a problem of spam account registrations the last year, and the answer to this question worked great
We limited the character count to 42 and that stopped the spam accounts.
But last week they started again ( not as frequent). They are getting between 40-65 characters into the first name field the first name attribute is limited to 42 characters:
Looking at the access logs I can see the same Russian IP hitting the captcha about the same time the account is being made, and when I ban that IP address the accounts stop.... until they get a new (Russian) IP address.
I don't understand how they are getting around the database validation rules for that field.