Fake Accounts using CAPTCHA

I’m receiving 1–2 fake accounts per day even with CAPTCHA enabled. Because Admin has no bulk user administrative functionality this makes dealing with these fake accounts a time consuming process as they have to be scrutinized by email and deleted one at a time—which is very arduous.

How are others dealing with fake accounts? How is it possible they could be slipping past the image CAPTCHA—they’re not that easy to crack. I’m using Gitea 1.13.0.

I read recently (it was on the internet so therefore must be true) there are subscription services available where captchas are solved by outsourcing to Chinese workers real-time.
I haven’t fact checked but I could see how that could work for pro-spammers.

Have you enabled email confirmation?

Indeed. I’m going on the theory they’re paid shill accounts. That’s okay as their are not nearly the number as without CAPTCHA.