Apparently requiring logins is no longer enough to keep the spammers out of trac. :/ See http://trac.adiumx.com/ticket/65#comment:18 for an example.