2FA, captcha and blacklist are the basics done right.

Not flashy, but they reduce spam and account takeover risk from day one.