Well scammers are everywhere on the net and there is no fool proof way to stop them.
I run a vbulletin 4.20 site and have the realtime captcha they provide enabled and I still see scammers on my site in my forum and have posts to delete almost every couple days.
Now with that said our latest code which has been out awhile is 5.23 and indeed there is captcha if you have all the proper files installed and have captcha turned on.
I checked my site and its definately there
Contact Form - Reeftalk Classifieds
Now with that said there are two things to do to turn on captcha
1. You need to have the global permission under registration options turned on for captcha
2. You can refine permissions under edit usergroups option in admin for which groups have to have captcha. Meaning if your checking your link logged in as admin and you do not require captcha then you would not see captcha.
So really it is all up to how you have it set. You need to also realize that there are scammers out there that are not just bots but real human beings so if it be a bot that is designed to break through captcha or a human that can read and answer the captcha then they are going to be able to post.