I’d also suggest the SI Captcha Anti-Spam plugin. It puts a little captcha box next to the comment box which you have to fill in before you can post, which disappears if you’re logged in. You can also make it so you have to fill one in when you register to prevent bots from just making accounts.