I thought I'd posted this before but I don't see it in the previous entry:

I had a problem with getting spam on the phpbb on my site, but once someone mentioned a way of fixing it, I fixed it perfectly. Since making the change, I have gotten literally no spam.

The trick involves two premises:

• you are only receiving spam from robots
• you are willing to use a captcha of some kind

Originally, I had phpbb's captcha turned on, and it wasn't helping. Eventually I realized this was because robots knew how to defeat it somehow, not because the spammers were human.

The second issue may be more significant for you in terms of your willingness to pursue it. You currently have a sort of inverse captcha with hidden form fields or extra submit buttons (or forced preview), but you have to go a little farther in adding a barrier to detect humans. This can be simple, and trivial, and you can probably create a cookie so people only have to do it once even if they're not logged in.

The trick in the phpbb case is that people are attacking phpbb, not my site. All you have to do is write a site-specific captcha that nobody else has, and the script authors never find you, never know about you, and never attack you. (This would not work, of course, if you had a popular site; I do not have any recommendation for the authors of phpbb that can solve their problem; only for individual users of phpbb.)

So, for example, the following captcha would do the trick, both for creating phpbb user accounts, or for posting comments:

  To prove that you are a human, not an automated comment-spamming program,
  type the letter 'x' in the following box:
  [textarea]
  :Post Comment:

Any human can trivially do this, and the odds of a bot even attempting to guess the right text is extremely low (at least until this technique becomes well-known, in which case we'll need to use the human element a little more, like saying 'what is 1+1?'). And any user who accepts non-session cookies need only do it once.

But you have to be willing to make humans do this, and you have to burden them with the knowledge that there are comment-spamming robots if you want them to not be confused why they have to do this. (I actually have had people fail to create phpbb accounts on my site because they were confused by my captcha--because I didn't explain it clearly enough.)

An interesting variant of the simple captcha approach that I've heard of is to have some JavaScript on the page that automatically fills in the captcha form field and then hides it from the user. That way people with JavaScript turned on (which is probably most real visitors) don't even notice it, while spam robots are still impeded since few of them try to run JavaScript.