Captchas help with spam protection, but they are not a silver bullet that would magically defeat all spammers. The most significant drop in spam account creation I noticed when I changed SSH access to my server to whitelist. On top of that I'm using ReCAPTCHA and a plugin for blocking particular usernames, e-mail addresses, or domains from registering accounts. That reduced the spam account creation rate to a manageable number (5-10 per week). But still, fighting off spammers remains a continuous effort. At least until shooting spammers on sight becomes legalized.