I want to say that I saw a post at some point about one of the popular instances (was it beehaw or lemmy.world?) not requiring users to answer a challenge question during signup. Does it seem like email verification is sufficient to mitigate bots or does a challenge question help too, do you think? Sopuli required both. Unverified users can apparently post?