Exactly. The spammers have already gotten around that. That’s how I got hit with so many comment spams last weekend.
Right now I’m using a combination of the SpamAssassin plugin and realtime blackhole lists, along with some fairly strict user agent filtering. And a custom 403 page in case a legitimate user happens to accidentally get blocked.
The blackhole lists let people view the site, but not post comments (WP closes comments/pings entirely if they’re on the blackhole list, and I’ll have this hack out shortly. Of course I said that yesterday, but now that I’m snowed in, it might actually happen.)