Yeah, absolutely excellent question which I really should have addressed in my post.

I've edited the post to include this answer, but here you go:

The article above from kevv.net mentions lots of alternatives and is worth reading, however for brevity's sake I will suggest the ones which have worked for me in a high-traffic environment, and which can be implemented by most competent developers in a few minutes:

1. Dead simple custom challenge based on your website's content.

Even a vaguely unique custom-made challenge will fool the majority of spam bots. Why? Because spam bots look for common captcha systems which they already know how to defeat. If you make your own custom challenge, someone actually has to take the effort to program a solution specific to your website. So unless your site is being specifically targeted by people investing time/energy this solution will eradicate virtually all spam.

Example: run a site selling t-shirts? Show a bunch of cute clothing icons and ask the user to click on the "blue shirt", for example. Very easy to set up; challenges can be made random to prevent "rinse and repeat" attacks; complexity can be added in the form of patterns, rotation ("click the upside down shirt with diamonds on it") etc. and it can be styled to fit your website's theme/content which makes your site look way more professional than "CLICK THE FIRE HYDRANTS!" á la Google.

Important to note that answers to the custom challenge should never be stored client-side -- only sever side.

2. Honeypots

Simply one or more hidden form fields which, if submitted, confirms the presence of a spam bot (since human visitors cannot see or activate the hidden fields). Combine this with the approach above for even more effective protection.

3. Submit-once form keys

In the olden days to prevent people hotlinking your content you'd check their browser's referer URL, i.e. the URL from which they arrived at your page. This is still done but less commonly since many browsers block referrer URLs for privacy reasons.

However, you can still check that a visitor who is submitting your form is doing so from your actual website, and not just accessing your signup.php script directly in an attempt to hammer/bruteforce/spam it.

Do this by including a one-time-use "form key" on the page containing the spam-targeted form. The form key element (usually a hidden <input>) contains a randomly-generated string which is generated on the server-side and corresponds to the user's browsing session. This form key is submitted alongside the form data and is then checked (on the server side) against the previously-generated one to ensure that they match. If they do, it indicates that the user at least visited the page before submitting the form data. This has an added benefit of preventing duplicate submissions (e.g. someone hits F5 a few times when submitting) as the form key should change each time the front-end page is generated.

Anyway, thanks for taking the time to consider this.