The mergeUsers tool would be most helpful, I think, in the case of a large number of users. In the other post, James describes using a PHP script to call the mergeUsers tool on a list of hundreds or thousands of usernames.
ReCAPTCHA and email validation are setup in config.inc.php.
In my personal experience, we found that spammers had completed both ReCAPTCHA and email validation, so our best response was using the plugins: