Gordon Weakliem notes that CAPTCHA is failing as a spam stopper - and that turning comments off for older posts is the best medecine:

I've said it before, and I'll say it again: the only effective deterrent against weblog comment defacement is to disallow comments on posts older than a month.  Sam Ruby's system seems to be effective as well, though IIRC that's a multifaceted system - forcing preview, throttling comments from a single IP, probably other things that I don't remember at the moment.

I go further; I turn comments off for any post that's off the front page (and thus, out of the feed). I can track problems as they occur that way. There are people who've been dismayed by this, but hey - it's simply part of the damage caused by the baser elements out there on the web.