Dealing with wave after wave of spam

It's weird that I'm not seeing much discussion on this topic, which makes me wonder what I'm doing wrong. Lately, we've been having issues with waves of spam coming in from accounts that are getting auto-generated on various bulk mail sites. I DO use the captcha on registration, and I block certain email TLDs, especially when the spam wave happens - but I can't do that until the attack happens. I also require email addresses be verified. Dozens and dozens of accounts I have to go through and delete content on though. I've even checked permissions, and these accounts say "Not Verified", and those shouldn't even have the ability to add discussions at all.

Does no one else have any trouble with waves of spam registration and posts? Am I missing some stupidly simple config setting here?