Yes.
In my experience with various webapps, spam bots don’t have much of an issue to create gmail and other e-mail addresses. On my site, we’re also not excluding temporary mail disposable email addresses. There’s also some other forum software / forums that allow sign-up without (or without a valid) e-mail address and this also didn’t cause any issues that I could see. So I don’t see e-mail addresses as much of a barrier to avoid a flood of bot / DOS attack accounts.
But I can see where you might be coming from. Allowing users to sign-up without e-mail address might expand into lots of follow-up issues. What if there is a huge flood of bot attacks and/or DOS attack where a crazy number of forum accounts is created?
In that case, anti-spam prevention measurements would be required. But these would not be specific to those forum instances where e-mail is optional versus those where e-mail is mandatory.
That is because spammers also nowadays have access to lots of created or hacked e-mail addresses. They could also use temporary e-mail providers. Or buy/steal a domain name and setup their own e-mail server just for the purpose of spammy forum setups.
The same questions would arise from both, email using/not using users. For the sake of this discussion, theoretical questions.
- How to view all accounts that were created since X days, that were logged in less than X minutes, that have 0 posts? Probably bot accounts. I want to find and delete all of these.
- How to add a custom question / puzzle / captcha / whatever before accepting a sign-up?
- Could the admin panel please have an easy button where admins can easily approve/unapproved new-signups capable of handling mass registration spam?