Just in case you’re using WordPress, the most successful combination I’ve found so far to Kill Spam Dead (in regard to Comment and Trackback spam) is this:
AuthImage for Comment Spam; I have had no problems with this. No comment spam has made it through since I implemented this. Yay.
Go here for trackback spam. It works. I started getting my first vomit-like chunks of trackback-spam today and I tried a few fixes. This is the only one that worked.