2
The verification code might not work if you have Protector installed.
Another good solution to avoid spam is to rename the file sign.php in whatever you want.
You also have to change it in the file include/form_sign.inc.php, line 32 and 101.
Spam-bots are looking for the file sign.php and by renaming that file you're fooling the spam-bots.
You also might want to comment out line 223 in sign.php otherwise all the right blocks are displayed twice.
// include XOOPS_ROOT_PATH."/header.php";
(Edit: this was the case with version 2.40b, not sure if it's the same for version 2.40a of XF Guestbook...)