My top choice for curbing spam

WP Bruiser has more security features than I need and would prefer, but it is still the most effective, low-overhead solution I know of now that works with Postmatic and server-side caching. I use it as the first line of defense along with Block Bad Queries and Blackhole for Bad Bots. In combination with other brute force protection and Akismet as the backstop, spam does not get through. It’s also done an admirable job of mitigating DDoS attacks.