BuddyPress.org

@jwack

hi, I had similar issues… even after removing the blog signup at registration, spammers would sign up, activate their accounts, and then create a new splog. to help cut down, I tried these steps:

– changed my registration slug in bp-custom.php:
define ( ‘BP_REGISTER_SLUG’, ‘join’ );

– also added a redirect of wp-signup.php inside bp-custom.php:
function register_redirect() {
if (strpos($_SERVER, ‘wp-signup.php’) !== false ) {
$url = ‘http://www.mysite.com/join’;
wp_redirect($url);
exit;
}
}
add_action(‘init’, ‘register’);

those two helped but didn’t completely remove the issue, this plugin really nailed it for us though:

– installed this plugin: https://wordpress.org/extend/plugins/invitation-code-checker/ (since we have a local comm site, we just used a zip code as the invite code)
Not sure how your site is set up but perhaps you can find a way to use it too, may even allow you to re-enable blog sign up at registration. It says Tested up to: WordPress MU 2.8.4 but I have WP 3.0.3 with network enabled and BP 1.2.6 and still seems to be working just fine.

Most of these suggestions were pulled from helpful posts on BP, hopefully they help you out a bit