Got an email from Peter Theony, noticing that we'd been fighting some TWikiSpam. He recommended the plugin, which has kept twiki.org spam-free for several weeks now. I'm not able to test it right now, as you need to have two boxes at once -- one for admin and one to test with. I'll do it from home.
If anyone wants to give it a try before I get to it, see [link|http://twiki.org/cgi-bin/view/Plugins/BlackListPlugin|here] for a description of what you have to do. I've run all the steps up to [link|http://twiki.org/cgi-bin/view/Plugins/BlackListPlugin#Plugin_Installation_Instructions| Dakar release only]. I haven't checked yet if we're running Dakar, but I don't think so.
Assuming this all works, we should be able to restore the user file and re-enable joining. Last step will be to add the magic number checking to the registration form.