If you don't verify emails (or SMS, or use something like Facebook Connect, or make people prove they have a credit card, or...) you will get totally screwed with bot accounts. That was true in '99 and it is still true.

To take an example of why CAPTCHAs don't really work, circa 2009 there was a site a lot like HN that didn't have email checks and I made about 1000 fake users for it that had halfway decent profiles generated for them (got pictures out of a big pile of cartoon characters, real people, abstract things, etc. -- nobody seemed to care that I made no effort to make the gender of the profile pic match the name)

With those accounts I had as much control over that site as I wanted. Certainly I could write a mediocre blog post and people would wonder why it got so many upvotes but they never got past leaving comments wondering about this. I did it all with Tor so I never ran out of IP addresses (pro tip: look at Tor exit nodes as nests of problem users) I don't think the operators of the site cared, my bots voted for random articles so they weren't obviously part of a voting ring, my bots were polite and never made trouble.

Note I could have solved 1000 CAPTCHAs myself in 10 hours or paid somebody else to do it; it just wouldn't have stopped me from making enough fake accounts to make a voting ring that would take heavy use of statistics to catch. I could have easily added something to my mail server so I could make multiple users on the same email domain, but if my whole voting ring came from the same or a small set of domains it would have been easy to catch.

(Granted hackers and spammers really do create gmail accounts by the 1000 but they are dealing with Google's black ice)