here is another good one
http://wordpress.org/extend/plugins/impostercide/
not sure here everyone knows, but wordpress will automatically approve comments if the spammer knows the user and email that is posting the comment, same with the admin account if they know the email address, it will auto post.