I've got an ugly-but-it-works approach to fighting spam.

Update: this works. Perfectly. I haven't had a single piece of comment spam since implementing it. Of course, if spammers decide to start creating comment spam with less than three URLs, I'm hosed, but until then, I'm fine. Almost by definition, they won't. Having three links instead of twenty seems to be not worth it.