For my point of view, it's not a bug (a bug is a no-conformity in a provided and specified function). It's rather a lacking function or option... but it's only exploiting the words. Doesn't matter.
But I cannot use punbb in an "open" configuration (guest allowed, or no e-mail procedure), so I think there is a fundamental problem. If a function is provided, we should be able to use it without extension.
If a spambot can fight a forum software, it can not fight all the administrator in the world. So why not an option with two text fields, a "question" and an "answer", both defined (as often as wished) by the admin? And each guest message or inscription, the "question" is displayed, and the answer is checked (whithout spaces, no capital letters). Like a standard anti-captcha, but here, a spambot cannot spam all the forum in the world, each forum must be first manually attacked.
PS: No mistake: I like punbb, i donated someting for it, and i will donate again when 1.3 will be here. My contribution (like others I think) are not criticisms. I just want to see a better punbb!