Because it has no protection against bot account creation. The site gets picked up by a footprint so spammers know there is a forum at mises.org and bam, you’re on a list somewhere. Then a trainable bot figures out how to create and verify an account, which is really easy when you don’t modify the behavior of the template from the stock behavior. Even this doesn’t help sometimes because if your site is valuable enough spammers create and maintain human-created login procedures to keep getting in (the good news is that the vast majority of forums aren’t worth the effort).
IP blocks don’t help, it’s all done through proxies. Captcha may help, depending whose list you got on. Serious spammers tie their apps into DeatchByCaptcha which has real humans solving the captchas, but most spammers aren’t serious. The best part is the more “clean” your site is the more valuable you are to the serious spammers that you really can’t do anything about.
The best thing you can do is have a registration page with a random thing to do to verify that that the registrant is human. The randomness is the important part. One time it could be a math question, the next time it could be a “type the color shown”, the third time it could be “type the full name of the institute”, etc. If you do that, you’re instantly unappealing to all spammers.