I've added double opt-in which involves a captcha and I've also added additional fields hoping that might stymie their efforts and yet they still get through.
Fortunately they're easy enough to spot because the lion's share come from the same dozen or so extensions/domains or similar domains.
More obvious is that one of my required fields essentially asks subscribers what they want to learn by signing up for my list, and the bots always paste in the standard biography BS (my name is ... and I like ...)
Nevertheless, it's annoying and requires constant upkeep on my end. Anyone have any solutions beyond what I've tried?