What you're already doing (out of band `confirmed`) is a third option that can be used alongside the two I introduce
Source Link
  • Creating an account is open.
  • Everyone, including anons, can edit pages in talk namespaces but cannot edit main until eitheran account is confirmed. This happens when a user A. they confirmconfirms an e-mail address or, B. their accounts become autoconfirmedgains autoconfirmed status (set to 4 days and 2 talk edits on my wikis), or C. completes what amounts to your current process of contacting a wiki administrator out of band through a related means where the user is already known (such as a forum or IRC channel).
  • Install the ConfirmEdit extension with QuestyCaptcha, customize its questions and answers to relate to the gamecommunity's topic, and rotate the questions out every few months. This way, a generic MediaWiki spambot not targeted to your particular site will fail to create accounts and fail to post links. I have had bad experience with ReCAPTCHA; because it's so widely used, generic spambots target it far more than they would a simple game-specific Q&A.
  • Install the AbuseFilter extension to stop spambots that have discernable patterns in their spam or discernable patterns in their usernames.
// Don't allow anyone other than site staff to edit non-talk pages
// until they've confirmed their e-mail address or waited a few days.
// 2010-08-09: MediaWiki 1.14 changed how emailconfirmed works.
$wgNamespaceProtection[NS_MAIN]     = array('editmain');
$wgNamespaceProtection[NS_USER]     = array('editmain');
$wgNamespaceProtection[NS_PROJECT]  = array('editmain');
$wgNamespaceProtection[NS_IMAGE]    = array('editmain');
$wgNamespaceProtection[NS_TEMPLATE] = array('editmain');
$wgNamespaceProtection[NS_HELP]     = array('editmain');
$wgNamespaceProtection[NS_CATEGORY] = array('editmain');
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
$wgImplicitGroups[] = 'emailconfirmed';  #// Hide group from user list
$wgGroupPermissions['emailconfirmed']['editmain'] = true;
$wgGroupPermissions['autoconfirmed']['editmain'] = true;
$wgGroupPermissions['confirmed']['editmain'] = true;
$wgGroupPermissions['emailconfirmed']['skipcaptcha'] = true;
$wgGroupPermissions['confirmed']['skipcaptcha'] = true;

// Four days and two edits to become autoconfirmed.
// If not also emailconfirmed, these have to be talk page edits.
$wgAutoConfirmAge = 4 * 86400;
$wgAutoConfirmCount = 2;

// Make page moves and uploads also require autoconfirmedconfirmation
$wgGroupPermissions['user']['move'] = false;
$wgGroupPermissions['autoconfirmed']['move'] = true;
$wgGroupPermissions['confirmed']['move'] = true;
$wgGroupPermissions['user']['upload'] = false;
$wgGroupPermissions['autoconfirmed']['upload'] = true;
$wgGroupPermissions['confirmed']['upload'] = true;

// Configure QuestyCaptcha from its own file
require_once("$IP/questy.php");

// https://www.mediawiki.org/wiki/Extension:AntiSpoof
// Makes sure that usernames aren't too similar to other usernames.
// We need it before we can install the ABUSE filter.
require_once("$IP/extensions/AntiSpoof/AntiSpoof.php");

// https://www.mediawiki.org/wiki/Extension:AbuseFilter
// Allows flagging, warning, or rejecting edits by heuristics
// including regular expressions, user groups, and more
require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );
$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

// https://www.mediawiki.org/wiki/Extension:User_Merge_and_Delete
// Allows merging a user's contributions into another user and then
// deleting the old user.  Experimental use to merge spambots.
require_once( "$IP/extensions/UserMerge/UserMerge.php" );
$wgGroupPermissions['bureaucrat']['usermerge'] = true;

// https://www.mediawiki.org/wiki/Extension:Renameuser
// Lets bureaucrats rename users, such as users with offensive names
// or users whose fursonas have changed
require_once("$IP/extensions/Renameuser/SpecialRenameuser.php");

// https://www.mediawiki.org/wiki/Extension:Recent_Changes_Cleanup
// Lets sysops and users with 100+ edits turn on the bot flag of edits
// Good for hiding spam and reverts that have been taken care of
require_once("$IP/extensions/RecentChangesCleanup/RecentChangesCleanup.php");
$wgGroupPermissions['sysop']['recentchangescleanup'] = true;
$wgGroupPermissions['recentchangescleanup']['recentchangescleanup'] = true;
  • Creating an account is open.
  • Everyone, including anons, can edit pages in talk namespaces but cannot edit main until either A. they confirm an e-mail address or B. their accounts become autoconfirmed (set to 4 days and 2 talk edits on my wikis).
  • Install the ConfirmEdit extension with QuestyCaptcha, customize its questions and answers to relate to the game, and rotate the questions out every few months. This way, a generic MediaWiki spambot not targeted to your particular site will fail to create accounts and fail to post links. I have had bad experience with ReCAPTCHA; because it's so widely used, generic spambots target it far more than they would a simple game-specific Q&A.
  • Install the AbuseFilter extension to stop spambots that have discernable patterns in their spam or discernable patterns in their usernames.
// Don't allow anyone other than site staff to edit non-talk pages
// until they've confirmed their e-mail address or waited a few days.
// 2010-08-09: MediaWiki 1.14 changed how emailconfirmed works.
$wgNamespaceProtection[NS_MAIN]     = array('editmain');
$wgNamespaceProtection[NS_USER]     = array('editmain');
$wgNamespaceProtection[NS_PROJECT]  = array('editmain');
$wgNamespaceProtection[NS_IMAGE]    = array('editmain');
$wgNamespaceProtection[NS_TEMPLATE] = array('editmain');
$wgNamespaceProtection[NS_HELP]     = array('editmain');
$wgNamespaceProtection[NS_CATEGORY] = array('editmain');
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
$wgImplicitGroups[] = 'emailconfirmed';  # Hide group from user list
$wgGroupPermissions['emailconfirmed']['editmain'] = true;
$wgGroupPermissions['autoconfirmed']['editmain'] = true;
$wgGroupPermissions['emailconfirmed']['skipcaptcha'] = true;

// Four days and two edits to become autoconfirmed.
// If not also emailconfirmed, these have to be talk page edits.
$wgAutoConfirmAge = 4 * 86400;
$wgAutoConfirmCount = 2;

// Make page moves and uploads also require autoconfirmed
$wgGroupPermissions['user']['move'] = false;
$wgGroupPermissions['autoconfirmed']['move'] = true;
$wgGroupPermissions['user']['upload'] = false;
$wgGroupPermissions['autoconfirmed']['upload'] = true;

// Configure QuestyCaptcha from its own file
require_once("$IP/questy.php");

// https://www.mediawiki.org/wiki/Extension:AntiSpoof
// Makes sure that usernames aren't too similar to other usernames.
// We need it before we can install the ABUSE filter.
require_once("$IP/extensions/AntiSpoof/AntiSpoof.php");

// https://www.mediawiki.org/wiki/Extension:AbuseFilter
// Allows flagging, warning, or rejecting edits by heuristics
// including regular expressions, user groups, and more
require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );
$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

// https://www.mediawiki.org/wiki/Extension:User_Merge_and_Delete
// Allows merging a user's contributions into another user and then
// deleting the old user.  Experimental use to merge spambots.
require_once( "$IP/extensions/UserMerge/UserMerge.php" );
$wgGroupPermissions['bureaucrat']['usermerge'] = true;

// https://www.mediawiki.org/wiki/Extension:Renameuser
// Lets bureaucrats rename users, such as users with offensive names
// or users whose fursonas have changed
require_once("$IP/extensions/Renameuser/SpecialRenameuser.php");

// https://www.mediawiki.org/wiki/Extension:Recent_Changes_Cleanup
// Lets sysops and users with 100+ edits turn on the bot flag of edits
// Good for hiding spam and reverts that have been taken care of
require_once("$IP/extensions/RecentChangesCleanup/RecentChangesCleanup.php");
$wgGroupPermissions['sysop']['recentchangescleanup'] = true;
$wgGroupPermissions['recentchangescleanup']['recentchangescleanup'] = true;
  • Creating an account is open.
  • Everyone, including anons, can edit pages in talk namespaces but cannot edit main until an account is confirmed. This happens when a user A. confirms an e-mail address, B. gains autoconfirmed status (set to 4 days and 2 talk edits on my wikis), or C. completes what amounts to your current process of contacting a wiki administrator out of band through a related means where the user is already known (such as a forum or IRC channel).
  • Install the ConfirmEdit extension with QuestyCaptcha, customize its questions and answers to relate to the community's topic, and rotate the questions out every few months. This way, a generic MediaWiki spambot not targeted to your particular site will fail to create accounts and fail to post links. I have had bad experience with ReCAPTCHA; because it's so widely used, generic spambots target it far more than they would a simple game-specific Q&A.
  • Install the AbuseFilter extension to stop spambots that have discernable patterns in their spam or discernable patterns in their usernames.
// Don't allow anyone other than site staff to edit non-talk pages
// until they've confirmed their e-mail address or waited a few days.
$wgNamespaceProtection[NS_MAIN]     = array('editmain');
$wgNamespaceProtection[NS_USER]     = array('editmain');
$wgNamespaceProtection[NS_PROJECT]  = array('editmain');
$wgNamespaceProtection[NS_IMAGE]    = array('editmain');
$wgNamespaceProtection[NS_TEMPLATE] = array('editmain');
$wgNamespaceProtection[NS_HELP]     = array('editmain');
$wgNamespaceProtection[NS_CATEGORY] = array('editmain');
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
$wgImplicitGroups[] = 'emailconfirmed';  // Hide group from user list
$wgGroupPermissions['emailconfirmed']['editmain'] = true;
$wgGroupPermissions['autoconfirmed']['editmain'] = true;
$wgGroupPermissions['confirmed']['editmain'] = true;
$wgGroupPermissions['emailconfirmed']['skipcaptcha'] = true;
$wgGroupPermissions['confirmed']['skipcaptcha'] = true;

// Four days and two edits to become autoconfirmed.
// If not also emailconfirmed, these have to be talk page edits.
$wgAutoConfirmAge = 4 * 86400;
$wgAutoConfirmCount = 2;

// Make page moves and uploads also require confirmation
$wgGroupPermissions['user']['move'] = false;
$wgGroupPermissions['autoconfirmed']['move'] = true;
$wgGroupPermissions['confirmed']['move'] = true;
$wgGroupPermissions['user']['upload'] = false;
$wgGroupPermissions['autoconfirmed']['upload'] = true;
$wgGroupPermissions['confirmed']['upload'] = true;

// Configure QuestyCaptcha from its own file
require_once("$IP/questy.php");

// https://www.mediawiki.org/wiki/Extension:AntiSpoof
// Makes sure that usernames aren't too similar to other usernames.
// We need it before we can install the ABUSE filter.
require_once("$IP/extensions/AntiSpoof/AntiSpoof.php");

// https://www.mediawiki.org/wiki/Extension:AbuseFilter
// Allows flagging, warning, or rejecting edits by heuristics
// including regular expressions, user groups, and more
require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );
$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

// https://www.mediawiki.org/wiki/Extension:User_Merge_and_Delete
// Allows merging a user's contributions into another user and then
// deleting the old user.  Experimental use to merge spambots.
require_once( "$IP/extensions/UserMerge/UserMerge.php" );
$wgGroupPermissions['bureaucrat']['usermerge'] = true;

// https://www.mediawiki.org/wiki/Extension:Renameuser
// Lets bureaucrats rename users, such as users with offensive names
// or users whose fursonas have changed
require_once("$IP/extensions/Renameuser/SpecialRenameuser.php");

// https://www.mediawiki.org/wiki/Extension:Recent_Changes_Cleanup
// Lets sysops and users with 100+ edits turn on the bot flag of edits
// Good for hiding spam and reverts that have been taken care of
require_once("$IP/extensions/RecentChangesCleanup/RecentChangesCleanup.php");
$wgGroupPermissions['sysop']['recentchangescleanup'] = true;
$wgGroupPermissions['recentchangescleanup']['recentchangescleanup'] = true;
Source Link

You could try finding another way to control spambots on your MediaWiki that is more convenient for new users than requiring moderator approval. The following policy has worked well for two wikis that I admin:

  • Creating an account is open.
  • Everyone, including anons, can edit pages in talk namespaces but cannot edit main until either A. they confirm an e-mail address or B. their accounts become autoconfirmed (set to 4 days and 2 talk edits on my wikis).
  • Install the ConfirmEdit extension with QuestyCaptcha, customize its questions and answers to relate to the game, and rotate the questions out every few months. This way, a generic MediaWiki spambot not targeted to your particular site will fail to create accounts and fail to post links. I have had bad experience with ReCAPTCHA; because it's so widely used, generic spambots target it far more than they would a simple game-specific Q&A.
  • Install the AbuseFilter extension to stop spambots that have discernable patterns in their spam or discernable patterns in their usernames.

Here's the spam control stuff from my LocalSettings.php:

// Don't allow anyone other than site staff to edit non-talk pages
// until they've confirmed their e-mail address or waited a few days.
// 2010-08-09: MediaWiki 1.14 changed how emailconfirmed works.
$wgNamespaceProtection[NS_MAIN]     = array('editmain');
$wgNamespaceProtection[NS_USER]     = array('editmain');
$wgNamespaceProtection[NS_PROJECT]  = array('editmain');
$wgNamespaceProtection[NS_IMAGE]    = array('editmain');
$wgNamespaceProtection[NS_TEMPLATE] = array('editmain');
$wgNamespaceProtection[NS_HELP]     = array('editmain');
$wgNamespaceProtection[NS_CATEGORY] = array('editmain');
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
$wgImplicitGroups[] = 'emailconfirmed';  # Hide group from user list
$wgGroupPermissions['emailconfirmed']['editmain'] = true;
$wgGroupPermissions['autoconfirmed']['editmain'] = true;
$wgGroupPermissions['emailconfirmed']['skipcaptcha'] = true;

// Four days and two edits to become autoconfirmed.
// If not also emailconfirmed, these have to be talk page edits.
$wgAutoConfirmAge = 4 * 86400;
$wgAutoConfirmCount = 2;

// Make page moves and uploads also require autoconfirmed
$wgGroupPermissions['user']['move'] = false;
$wgGroupPermissions['autoconfirmed']['move'] = true;
$wgGroupPermissions['user']['upload'] = false;
$wgGroupPermissions['autoconfirmed']['upload'] = true;

// Configure QuestyCaptcha from its own file
require_once("$IP/questy.php");

// https://www.mediawiki.org/wiki/Extension:AntiSpoof
// Makes sure that usernames aren't too similar to other usernames.
// We need it before we can install the ABUSE filter.
require_once("$IP/extensions/AntiSpoof/AntiSpoof.php");

// https://www.mediawiki.org/wiki/Extension:AbuseFilter
// Allows flagging, warning, or rejecting edits by heuristics
// including regular expressions, user groups, and more
require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );
$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

// https://www.mediawiki.org/wiki/Extension:User_Merge_and_Delete
// Allows merging a user's contributions into another user and then
// deleting the old user.  Experimental use to merge spambots.
require_once( "$IP/extensions/UserMerge/UserMerge.php" );
$wgGroupPermissions['bureaucrat']['usermerge'] = true;

// https://www.mediawiki.org/wiki/Extension:Renameuser
// Lets bureaucrats rename users, such as users with offensive names
// or users whose fursonas have changed
require_once("$IP/extensions/Renameuser/SpecialRenameuser.php");

// https://www.mediawiki.org/wiki/Extension:Recent_Changes_Cleanup
// Lets sysops and users with 100+ edits turn on the bot flag of edits
// Good for hiding spam and reverts that have been taken care of
require_once("$IP/extensions/RecentChangesCleanup/RecentChangesCleanup.php");
$wgGroupPermissions['sysop']['recentchangescleanup'] = true;
$wgGroupPermissions['recentchangescleanup']['recentchangescleanup'] = true;

And the separate CAPTCHA configuration file questy.php:

<?php
require_once( "$IP/extensions/ConfirmEdit/ConfirmEdit.php");
require_once( "$IP/extensions/ConfirmEdit/QuestyCaptcha.php");
$wgCaptchaClass = 'QuestyCaptcha';

$wgCaptchaQuestions[] = array(
  'question' => 'What is the name of the NES\'s light gun?',
  'answer' => 'zapper'
);

// these aren't my real questions
$wgCaptchaQuestions[] = array(
  'question' => 'Ennyn Durin Aran Moria: pedo mellon a minno.',
  'answer' => 'mellon'
);