Yeah, I HAD set up some security questions, but it turns out then also have to specify "how many to use" out of them, which I didn't do. We used to use a third-party tool for the verification questions in pre-SMF-2.0, and that's what had cut our spam down to just a couple of posts per day, but without that in 2.0 the flood came in. Now I've got that configured properly, and hopefully we should be getting back to the pre-2.0 levels of spam or better.