Here's how bad spam has gotten:  My host, DreamHost, sent me an email saying they'd disabled comment posting on my blog, because it was getting hammered.  I checked and boy were they right - I had over 2000 messages in the moderation queue, most of it from yesterday.

I was going to add CAPTCHA to comment posting, but I came across this interesting plugin called WP-HashCash that basically makes your client do the CAPTCHA work rather than making a human do it.

Because it doesn't involve any human intelligence, a smart spam bot developer will be able to break it - but until they do, it makes for easy comment posting and no spam.