For completness: I think that protecting the "create new user" feature by htaccess, and documenting it (even with password) on the wiki would be enough to keep spam bots away. That can be done without updating media wiki should not take much time either. Marc Weber