Shoutbox

I'd log IP addresses with each shout, then if the spam is comming from the same address, just block it. When you do this, don't use a proper error message telling the spammer how you've blocked them, just put a generic error message and the spammer will think that it wasn't even directed at them.

The image verification thingy is often referred to as a captcha. There are bound to be some free ones ready to integrate, or just steal it out of MyBB.