I'm not trying to picky, just something else I noticed...
You guys still use beta tester or other automatically given groups?
Because when I was doing research to see if I could get CPM back, I stumbled upon a bit of info that applies to that -
If a hacker comes along and is given a group, a vunerability in phpbb2's coding is opened, allowing them to embed cookie stealers in their profiles.
No clue how it all works, just know it does. (It's how CPM came down.)
Just trying to give a suggestion, maybe you should wait about a week or so, and then give them the group...
That way you'd figure out what they're like.
It's also a good idea to research the IP's of new users, I'm pretty sure if you Google their IP, it should bring up some history, normal or hacker or spammer be.