I don't know if the attraction is the fact that PM posts will be notified by email or the fact that they have been able to hit so many PMs in a short period of time.
Yes the no email by default would be a good option unless you opt-in, allied with the No PMs for users with less than X posts llama/newbie, etc. and the double step registration before they can become a member. With these three restrictions PMs would still be workable for members but unattractive to spammers.
The two step registration and guests only having read only access, should also limit the drive by forum posting that we have also seen recently.
I don't know if IPs can/should also be recorded at registration as a form of deterrent.
PMs are an important function and I would hate to see them disappear or become unworkable. Many have now chosen to hide their email address in their profile settings (quite rightly), to avoid harvesting by bots scanning the publicly available forum pages, so with no email address you are forced to use PMs.