OK – nice and clear now, thank you.
Just one final query re #1 – if you only allow registration and login by paid membership (ie they have to have already paid) how can spam bots/human spammers get past either the registration or login page?
Cheers.