It seems there are 2 phpBB extensions which could protect the forum from spammers.
Authorized for URLs will "
disallow posts with urls in them if the permission to allow urls isn't set".
If that option is set to yes, the author of the post will not be able to make that post without removing the url.
If it's set to no, then the post with url will be placed into the moderation queue.
https://www.phpbb.com/customise/db/exte ... or_urls_2/
So this could be used for a probationary new user group to allow them to post, but not with any urls.
Auto Groups can "automate the process of adding and removing users from groups upon reaching specified milestones based on the user's activity"... such as the specified number of posts above.
https://www.phpbb.com/customise/db/exte ... to_groups/
... set the registered users group to not be able to post links (permission set to "no"). Then using the autogroup extension, once they have created 10 posts (or the number you choose to set) they get elevated to the full group which has 'post url links set to "yes"'.
https://www.phpbb.com/customise/db/exte ... pic/175411
Together, they could allow probationary users who have created the designated number of posts without urls to be automatically promoted up to the full access group which can post urls.
Some spammers will still bulldoze through by firing off dozens of replies in quick succession to surpass the designated milestone, but with autogroup management that can probably be similarly addressed.