I have had exactly the same problem. I have checked the integrity of my install as best as possible and even changed the admin passwords several times. WP and BP are always up to date but the spam never stops coming.
Its extrememly frustrating, the only solution that works for me is to to block all the countries where the SPAM originates from. Namely Asia, Eastern Block countries etc etc It works perfectly. But limits access to potential users from those countries.
What is seriously needed is something like Akismet but for user spam. I would pay Automattic a fee for an API key for this if my site were commercial. Perhaps they should really look into this problem because it crippling many WP sites and driving site admins to either go for custom solutions or the competition like Elgg
