Then came the registration page that would never submit, and of course I had to wonder if my email address was being sent to the central database each time.

Plugin permanently deleted.

When I did so, my register.php page started returning 500 internal server errors.

Any clue what the problem might be?

Can you put in a check into the plugin, to ensure that no registered usernames (e.g. "Admin") get blocked?

I've added a setting that can be edited in the file to change how many instances of the username/email/ip being a spam user are required to block them, defaulting at 3.

My primary concern is that the plugin is checking not only on the register form, but also on the login form. I would prefer the plugin:

a) only block registration attempts, not login attempts
b) whitelist already-registered usernames

Optionally, it would be nice if the plugin could provide options to check for any/all of IP address, email address, and username, on any/all of register.php, login.php, and login-form.php.

Is this plugin still being actively maintained? I noticed that the wp-nospamuser plugin from which it was ported is at version 7.2, and was updated 2 months more recently than bb-nospamuser.

Note that file_get_contents for external URLs will fail on many shared hosts that block fopen and such for non-local files as it's a security concern. Instead you could use a central function to retrieve remote urls and fall back to CURL or fsockopen instead. If this was WordPress you could use the snoopy class, I think bbPress 1.0 (unfortunately) has snoopy too.