Some of the moderation rule, I've seen from some other forums

1) Review before allowing visitors to sign up.
2) Strict moderation on post - spammy post gets deleted and spammer account too. After awhile those spammer will stay away.
3) Put in a capcha to block bots from auto signing up.

Last and most important - human review.

Take a look at the stop forum spam modification - Stop Forum Spam

How it works, lets say that I submit a spammer to the SFS site. When that spammer goes to register on your site, the script checks the SFS database and compares email address and ip address. If there is a match, the personal is denied from creating an account.

In the first week that I used SFS, it blocked somewhere between 400 - 500 spammers.

Besides SFS, I highly recommend that your friend stop using regular capthca and use ReCaptcha instead.

Email verification is nice, it almost useless. The spam bots broke the Gmail capthca phrase a long time ago. So the bots create an unlimited number of gmail accounts. As soon as one email account is blocked, the bot just creates another one.

No
No
No
and No

With a busy forum that gets 100+ new members daily - human review of those accounts is impossible.

Moderation of post - on busy forums, moderation of post is impossible. My forum gets between 1,500 - 2,000 post daily. Its impossible to review that many post

captcha is useless, you have to use ReCaptcha.

Human Review of a busy forum is useless.

One sure fire way to kill your forum is to review "every" post before its made public. By doing so, your limiting the forums ability to grow.

A good moderator will have scripts in place to make sure the spammers never get to register.

My forum gets about 1,000 - 1,300 new members monthly. I might get 2 or 3 spammers every 2 months.

Definitely switch to reCaptcha, spammers have a hard time dealing with it compared to other forms of captchas