Yes, I know I shouldn't be on 1.6, and we're in the process of upgrading.
Regardless, the site I'm working on its getting is registration form spammed, even after I added a honey-pot field. I'm not sure what this spam bot is doing, definitely not how it's getting round the extra field, and I'd like to stop it. Can anyone help?
note: Patching the site is not an option because it was super customized and the patches don't work.
As you may know Mage_Captcha is available only from > 1.7. You have to options:
Try to port Mage_Captcha to 1.6 als local module
Implement your own custom module
for second option see tutorial here https://www.gomage.com/blog/captcha-module-for-registration-in-magento/