Thanks the expert blog configurer and extender - Dave Burke, this weekend I am going to be reaching back in his archives to a golden oldie he sent me: Quick CAPTCHA Implementation review.
I'm also going to take his suggestion and make sure the MetablogAPI Comment XMLRPC backdoor is closed and locked tight.