After the spam problem of a few weeks ago, I took a single step that Adam Kalsey talked about a long time ago that has fairly well fixed my spam problem: I renamed the Movable Type comments script. I have had exactly one spam in the last three weeks.
Spam bots, it seems, are designed to go after the default script name. You can rename the script (view the source sometime to see what I called it) and change the value in the mt.cfg file. I’m sure my log file is full of 404 requests to mt-comments.cgi.
It doesn’t seem that spam bots are parsing the comment forms to find the name of the target script. It’s probably just a matter of time.