> is it's easy enough for spammers to get codes (between people posting lists of invites and the "create an account, age it and wait for it to start generating codes" tactic)

You should record the connection between new accounts and the accounts that issued the invite for these new accounts.

Then if you catch a spam account - you can quickly detect the whole tree of accounts to cleanup.
All new accounts in this tree - delete automatically (and automatically blacklist all IP networks that participated in creating these spam accounts).
The old and legitimate account that issued invite code - block from issuing any new invite codes again.

This automatic monitoring strategy should quickly stop invite-based spam accounts creation.