Pretty much any site that has "user generated content" will be abused by spammers.
It's an unfortunate fact of life.
in many respects it's like a war. The software vendors tweak and improve their software to stop spammers, but the spammers find new ways of getting around them.
Vbulletin has several options in a base install that can help, but unfortunately they're not going to be able to stop the more persistent spammers, which means you probably need to supplement your arsenal with some extra tools or plugins.
On your own install I'd strongly recommend that you force users to validate their email address before being able to post and turn on all the other validation checks that come with the software ie. reCaptcha
Here's a few that I've been using across the various Vbulletin installs I run:
Blockscript comes in two versions. With the free version you can block based on the user's IP address and country. So, for example, if you don't want anyone from India posting on your site you can simply blacklist the entire country. With the paid version you get a lot of other options that can help block against dodgy proxies and whole lot more.
The commercial license is well worth the investment if my logs are anything to go by. The developers are also very responsive if you submit feature requests, which is helpful.
If you want to do something slightly different (or radically different) then chances are you're not the only person who has had that idea. (Sorry - you're probably not that original 🙂 )
The number of plugins on the Vbulletin.org site is impressive with a lot of them being maintained to professional standards. In terms of fighting spam here's a couple that I've found helpful:
One Touch Ban & Cleanup - The "delete as spam" option in Vbulletin is useful, but if you're doing a cleanup operation you can easily find its limitations. This plugin will completely nuke a user and all traces of them quickly and easily. You can either ban them and delete everything or even delete them entirely. Handy when the Vbulletin tools have a post limit of 50!
Multiple Account Detection & Prevention - Blocks spammers from registering multiple accounts based on their IP and cookies. Very useful. Note: although the plugin is for 3.8.* it also appears to work fine on any of my 4.* installs.
vBStopForumSpam - allows you to check your user registrations against a shared database - think of it as the forum equivalent of a DNS blacklist. You can check both IP addresses and usernames. Be careful with the username check, as it can throw false positives. Also if the database site goes offline nobody will be able to register on your forum.
If anyone knows of any other plugins for dealing with spammers that target Vbulletin installs please do share!