Some of our clients are starting to be effected by this new form of spam.  I've done some research and seems like there's no full proof way to really tell between a human and a bot filling out a form. I know there's CAPTCHA but I think it's the wrong direction as it causes more work to the user and can be hard to read by the visually impaired. I also read that spammers are creating databases of the question/answer type tactics. If spammers are posting to the form externally it got me thinking that possibly checking the referring url could work. Any thoughts on this? A co-worker also thought of the idea of using image buttons which pass the x/y click coordinates to the page. Now I guess spammers could then just pass random coords as well to get around it. Then I got to thinking of using an image button with a dynamically generated image where the actual button would be rendered in a random area of a larger transparent image. That way the user would click on the button image and the code could check the coords. Another idea I've seen is randomly renaming the form field name. Seems this could just escalate to no end. Just wondering what other people have thought about this issue.

 It's not just visually impaired users who struggle with CAPTCHA - gives me a headache every time!

There's NoBot which comes as part of the ASP.Net AJAX toolkit... have a look at this

It's not a complete solution, but it does work.