i search that rate limits , to register , password reset , login pages. but don’t see it at settings 
( as example i want allow per ip only 5 try , then wait xx time)
About auto delete non activated accounts , i find it , but why even allow create them 
I want make impossible by using simple macros at browser make 100500 accounts . 
,how i say from real spamers notting not protect ( they use XRumer or neural network software ). But how i know most simplest captcha like “i am not a bot” work best, as it look at user actions.
but the message about scammers that sleep with their hands made me laugh , maybe some kids but real spamers doin’g it mass.
I can’t imagine a person who sits and manually creates thousands of accounts
but even so - after 10 captchas he would go crazy 
especially if it’s some kind of ridiculous Chinese captcha with a timer 
another great protection against human spammers is a browser fingerprint in the canvas