[Plugin: Spam Free WordPress] Race condition?

This is true. The message form information is stored temporarily in the browser, and clicking the back button should provide a new password with the comment intact and ready to resubmit, although there could be instances where this does not occur as expected. To date on high volume blogs I’ve tested on, this has not been a problem, but it could be in some rare situations.

I am working through several options for a future version that will eliminate this issue, which is likely to only occur on very high traffic blogs that experience unusually large volumes of comments that average blogs do not experience.

The difficulty solving this problem relates to server performance in generating a new password for each visitor, rather than only when a new comment is posted. Generating a new password for each visitor becomes an exponential problem as the load goes up. Generating a password only when a new comment is posted is the current approach, and causes no noticeable server impact. The idea is to minimize the server impact to negligible when implementing password generation for each visitor, so it will work on high traffic and low traffic blogs alike without noticeable impact. I am currently testing several strategies before this feature is rolled out in a future release.