one possible implementation:

http://www.roundup-tracker.org/cgi-bin/moin.cgi/RequireReCAPTCHAForLogin

uses Google reCAPTCHA. It is implemented as an extension that hooks
the login action. HTML needed for the login form and a
extensions/config.ini modification for activating and setting the
keys/site code needed by reCAPTCHA.

pro: uses recaptcha that should have a better II
cons: requires JavaScript which makes it unusable to most text based
browsers. while roundup does use JavaScript helpers, it can be used
without javascript with some enhancements missing. Being unable to login
however is more than a missing enhancement.

The plugin above doesn't really address the nonsense issue, but there
are recommendations on Google's web site on at least notifying the user
that they need js.