yup – so they pay > get redirected to the Buddypress registration page > once registered they get emailed a login activation link > they can then login when click on this link using the details that they used on their registration form. Thereafter they can just login from the main site using the buddypress login link. All this is protected by a membership level in s2member framework.
Does that sound protected enough from spammers to you?
