One way to be transparent to normal users, as long as your site uses javascript anyway, is to do a javascript (or flash, I suppose) hashcash implementation. If javascript on a typical browser takes 45 seconds to work out a solution, then that's enough to prevent spambots from just implementing it without driving the amount of spam they can send out way down.