In reply to Jeff Chandler.

Usually. I've seen some sites which get slammed even with that setup. If you throw in WP Hashcash, it kicks out a few more too, although in that situation you should use my plugin instead, as it combines Cookies for Comments and WP Hashcash into a single plugin which is slightly more efficient, since they don't launch their payloads separately ... http://wordpress.org/plugins/spam-destroyer/

Thankfully most bots are stupid and rely on the site having very little protection, but more aggressive ones can bypass these (as Otto calls them) "sporting methods". At that point you are in spam hell and the best I've come up with is to use a CAPTCHA. Thankfully even a very basic CAPTCHA has been enough to stop all the spam I've seen, but I'm guessing more heavily targeted sites would need to jump through a lot of hoops to block the bots.