I have done a lot of work on this recently.
The first registration process page inserts a record, checking username is unique and sends an e-mail to the e-mail address provided giving the following info:
Username (echo username)
Password (echo password)
and a link back to a validation page with an id number in the URL.
This validation page re-checks the password in the database and then simply changes the access level to validated, rather than the default "Unvalidated" value.
This process eliminated spam-bots and ensures that e-mail address are valid.
You can check it out at
www.freecrm.x10hosting.com and I can help you through the complex process if you need.