It would be so easy to put a sock in comment spam. Create a user system and then only allow approved users to post comments. WordPress took the time to make a user system but it only controls posting, not commenting. What’s with that? As it is, anyone (or any machine) that can type in an email address can post a comment.
I’ve browsed a mess of sites with all kinds of snazzy semi-heuristic, automatic scanning, sniffing plugin PHP edits and I still haven’t come across this fix. Feh.