Captcha won’t stop your spammers, so don’t make that your “stop all” method. Add an authentication method such as Twitter/Facebook (never use just Facebook, many users won't log-in with their Facebook accounts).
Be sure you have no more than 100 internal links on a page (and really the fewer the better). Focus the internal links to tell a proper story, take your user down simple paths. Links should lead your user through your site, not send them down an endless set of endless unrelated tunnels.
Check Google Webmaster Tools at least once a week for site crawler issues. When you find them, address them immediately. Generally, these can be fixed easily – in the case of a 404 error with a 301 permanent redirect or a server check for what is causing the 500 errors.
Make sure your content teams are writing original, unique title and descriptions for each page of content. When this isn't possible and the titles and descriptions will be auto-generated, make sure the scripts are pulling the content from a unique area of the page.
Additionally, Limit tagging to pre-set tags set by an SEO team or content manager, so you don't have an unlimited number of pages with ungrouped content. Tags were meant to group content together, so there should be a predefined set of descriptive tags. Also, make sure you don't have pages that have only one piece of content on each page. Use scripting to keep pages hidden from Google (i.e., no-index our your pages that have one piece or content on it that is the same as the original) until the page has more than one piece of content – after all it is not a tag group until it has more than one-piece right?
Run a page speed test (a plug in you can get with Firebug or Chrome) and check your homepage, plus your main landing pages. If your page speed is slow, work on your times. Often something as simple as proper image compression or server caching will make all the difference in the world.
Often malware or other attacks on your site will show as odd referrers in your analytics reports. Generally you will see URL strings that make no sense or you will click through your reports to see referrers that refer to scripting code or iframed references. When you see these, do not ignore the report. These anomalies are often indicators something is amiss.