You might be surprised how effective it is just to make sure the user has JavaScript on. Almost all spam-bots do not execute the JavaScript so it is a fairly reliable way to determine if a comment is spam or not. For users without JavaScript you can still degrade nicely to a "type this number in this box" question. Sure, it would be easy to write a bot to get around it, but spammers would be better off just looking for other blogs to spam.

I hate to sound self-promotional, but I did write a plugin that does this for WordPress which can be found here: http://wordpress.org/extend/plugins/jsspamblock/ .