I managed to avoid comment spammers for more than ten years just by using Javascript to set the POST URL. That meant that a static scan of the HTML didn’t give the spammer’s code anything to work with, and they’d have to manually load the page in a browser to figure out the correct endpoint, which wasn’t worth it for a small-fry blogger.
For more fun, if you tried to post a form to the URL that was in the HTML, you’d get sent to a page that triggered a firewall update blocking your IP address; since the submit button was disabled, this didn’t ban legit users who surfed without Javascript.
These days I just use Isso, which has been completely painless and spam-free.
-j