6
You should be able to block specific IP addresses through your hosting service so they never even see the xoops site. However most spammers are likely using IP addresses that are spoofed or not really the IP addresses they are at. If this is the case they can change that IP address easily.
You can try doing a search through the forums for things people have done with newer versions of xoops and see what will work with your version of xoops.
But realistically, you may find the effort it takes for you to prevent spammers from joining is more than it will take to upgrade your system to 2.5.6 with compatible modules.