The problem with user moderation of accounts is likely to be the sheer volume. I admin a small private forum relating to a long-defunct band, and things got so bad with spam that we now manually moderate all new registrations. Something like 80-90% of them are spam, and bear in mind that's just the ones that get through the character recognition tests and that have responded to the 'prove you're a person' e-mail - there are many more that don't get that far. A public site like RW could literally have 100's of dodgy registrations every day, and that's practically a full time job for someone just to check if they're valid. User moderation of new accounts is a fine idea, but you're asking people to potentially commit to quite a lot of work, and enthusiasm tends to wane rapidly.
Some of the spambots are very good, and it can take quite a bit of time to determine if registrations are real or not. Sometimes their lack of English gives them away, or they create loads of identical accounts, or they simply select the first option in all the drop-down lists in the registration, but they tend to learn and evolve rapidly. The smarter ones can be very realistic, so you're getting to the point of looking at IP addresses to see if where they are matches where they claim to be from, checking user names, e-mails & IP addresses against sites like www.stopforumspam.com, and sometimes you're just going off a hunch.
The main problem of course is that forums are continually under attack, with people looking for back doors and ways to hack in. Obviously the commercial forum software gets attacked the most because the potential for spammers is much greater, but it was only a matter of time before the RW forums came into someone's targets. I guess it's easy to get blase if you're not being attacked, and spending money on prevention when it appears that prevention is not needed can be a bit of a dilema, particularly when it's only a minor part of your overall product. The fact is though that you're going to get targetted at some point, and if you haven't prepared then you pay the consequences, and RW are doing now. In this instance RW have done a reasonable job in quite a short time to at least put a cap on the problem, but there is quite possibly no easy-answer automated method for them to stop it in the future as the attacks will evolve.