Yes that’s true … many spam tools go direct to the post comment url and inject spam that way. What you are looking to do is Block Comments coming from Referal URL’s that don’t include your host.
Just add this code to your theme’s function.php after a day or so you should see a drop off in spam. But nothing is 100% bullet-proof here 🙂
//Block Referal URL exploit for Comments
function verify_comment_referer() {
if (!wp_get_referer()) {
wp_die( __('You cannot post comment at this time, may be you need to enable referrers in your browser.') );
}
}
add_action('check_comment_flood', 'verify_comment_referer');