So I enabled manual approval for a bit, but it quickly became apparent that it's pretty pointless as the "bot" registrations look completely like real registrations. They are from unique IP, using a gmail or other public email address, with innocuous sounding names. No way to tell the spammers from the humans.
I've temporarily made it so that users with less than 10 posts cannot post links.