Only three fields are required, the comment itself, the IP of the submitter, and the site which is running the test. More details are useful, and give a better

Only three fields are required, the comment itself, the IP of the submitter, and the site which is running the test. More details are useful, and give a better result, but I've found that often an IP will submit hundreds of spam-comments in a short space of time, so requiring it allows you to do things like insta-reject comments from "known bad" sources for a short period of time. (Off the top of my head I cache bad IPs for 24 hours in some situations.)