A lot of these spam bots come from different country's,which you can block using your htaccess and this website http://incredibill.me/htaccess-block-country-ips,you you can block most country's that you don't want using your website ,which well also save you bandwidth denying these bots and spammers.
I think its some code in one of the mods in the shop that is allowing these bots to get past anything we all try with oxwall ,it must be something like that .
i think u are probably right, i dont have any anti spam plug ins or any thing just user approve,
well i have probably spoken to soon now i will get hundreds now to make up for not having them lol