I should add -- I'm protecting comment forms and sign-up forms, which certainly do get bot spam, but are lower-value targets than forums, etc. where the spammer

I should add -- I'm protecting comment forms and sign-up forms, which certainly do get bot spam, but are lower-value targets than forums, etc. where the spammer's content can actually be posted to a wider audience. Protecting forums is particularly hard because there are often real people involved in spamming them, sometimes with the aid of bots but not always. Some of them will fill in captchas, register user accounts, and post spam links along with half-assed original comments. Negative captchas are obviously useless against these; I've managed with having logs of moderators, but it's still unpleasant.