Visit the administration panel and enable visual confirmation:
General Admin, Configuration, Enable Visual Confirmation
Now, when an user registers, he gets a CAPTCHA.
User should pass a CAPTCHA on registering
CAPTCHA is a picture with letters. A human can recognize the letters, a computer — can't. Therefore, a bot can't register.
Or, at least, it should be so. Unfortunately, phpBB CAPTCHA is very weak, and bots pass it without problems.
Recommendation: don't use the standard Visual Confirmation.
Home: phpBB Antispam HOWTO