After noting a request to node 147 on my website (and I know I haven’t created 147 pages on it!) I decided to do some investigation.

It seems that I had left the posting of forum items open and available for anyone (and anything) to post to; without having to verify if they are human or not.

Unfortunately the version of the Captcha module I was using, had a bug that stopped me from enforcing the check; but I should have disabled access anyway.

Thankfully, there was an update to the module that I’ve installed that fixes the problem and now I shouldn’t get any more forum spam!