We started getting a spam registration a minute – granted, only for a couple minutes – but it was still worrying enough to look for some anti-spam firepower.

drush dl mollom

Push the changes to our live site.

Enable Mollom at admin/modules.

Register the site at Mollom.com.

Copy the API keys for public and private to the Mollom settings page on our site, admin/config/content/mollom/settings

...

hmm. It tells us "The configured Mollom API keys are invalid."