So far WP has caught all the spam comments I've gotten, but they're a pain to individually moderate. I've installed a spam-comment blocker that does some tricks with server-side timestamp hashes and javascript, which should be invisible to real commentors while blocking bots.

Which is to say, if you have any trouble commenting, send an email to d7 at my pipemaze.com domain and please let me know.