Another option is to simply remove the web interface for comments and only allow comments via the Comment API.

I have a hunch that most of the comment spam comes from people who stumble on my site via the web. Most people who post via the CommentAPI are using an aggregator and are thus subscribed to my site, or were referred by another subscriber.

UPDATE: I may be confusing Comment Spam with Comment Graffiti. As far as I can tell, I do not have any comments from any automated sources, nor comments advertising products on my site. The “spam” I have seems to merely be comments by random people who occasionally write offensive comments.