Any forum that lets people register and post will be found by spambots, usually within days. The phpBB team puts it plainly in its install guide: the attacks are generally not personal, spammers are just looking for accessible targets, and admins should set up anti-spam measures right after installing (phpBB 3.3 docs/INSTALL.html, "Anti-Spam Measures").
At registration
Use a question-and-answer CAPTCHA about your topic (for a fitness forum: "Which of these is a barbell exercise?"). Bots that beat image CAPTCHAs often fail niche questions.
Require email activation, or admin approval while the forum is small.
Limit registration attempts per session.
For new members
Put new accounts in a "newly registered" group whose first few posts need approval. phpBB and most major forum packages support this.
Block links and signatures until a member has a few approved posts.
Do not let brand-new accounts send private messages.
Ongoing
Keep the software and extensions updated. Old versions are easy targets.
Check the approval queue daily, and ban plus delete in one step.
Watch for "sleeper" accounts that register, wait, then edit old posts to add links.
Back up the database before bulk-deleting spam.
Do not
Leave registration fully open with no checks "just for launch."