This has been an ongoing nightmare for a few weeks for all phpBB board administrators. The spammers have figured out a way to automate registrations and email confirmations whether you have a captcha or a question-answer requirement.
For the time being and the foreseeable future, all registrations will need to be activated by an Administrator. Normally this will happen within minutes of registering, but sometimes there may be a delay of several hours when nobody is minding the store.
This should at least prevent the spammers from being able to post messages.