Still dealing with lots of spam, cleaned out a few hundred today via WordPress’s moderation tools and found hundreds more in the database.
Turns out they were coming in as trackbacks, against which there is no real defense except to disable them. Did that two ways: by turning off pingback/trackback in WordPress’s controls and moving the wp-trackback file.
My highest comment_ID is 31,649, while active comments only number 1974. Almost 31,000 spam comments, against less than 2000 real ones? Nice, real nice.