Flooding controls, yes.
(Our forum uses them, but it's a shorter time-frame and a rate that is more like 2 per minute or something.) A very determined/desperate person COULD still do it, but it wouldn't be very lucrative.
Generally forum spammers are low-paid virtual sweatshop help, and they get paid by the link/post, often very, very little per post (think pennies at the outside).
A combination approach works pretty well, incidentally-- that is, have post-controls that top out at some number of posts on the forum in order to show up at all... and/or flood controls, and/or regional/aggressive spam filtering, and/or control usergroups so that you have to manually move new members into more privileged membergroups (that way spammers can't defeat the post-count thing through sheer persistence).
