You might want to start with deleting all the accounts used to post spam and then locking things down so registration requires admin approval.
Ultimately, if you don't have a lot of time to keep up with patches and moderation, consider the forums we use, SMF (Simple Machines) with the anti-spammer module. SMF has had very few security patches since I've been using it here and the anti-spammer module has cut down dramatically on the number bogus registrations we've had to chase after.
Maybe phpbb3 has similar improvements...
Thankfully, right now, you have only had to deal with spam posts. Get things patched up soon and make good backups before some malicious hacker decides to delete everything on your forums - I've seen it done, especially once you annoy the spammers by deleting their posts.