I've added a spam filter to the user registration form. I'm going to leave it be for a few days to see how well it works. If it blocks most of the fake registrations (which have accelerated to ~50/day) then I'll disable the requirement that accounts be approved by an administrator.
If it fails, then I may have to rely on CAPTCHAs. And I really don't want to do that. I've always found them annoying.