scriptygoddessChristine posted a few links here about this problem that's been coming up… if you already have "subscribe to comments" running – then you'll need to implement Burningbird's suggestion a little differently – and actually, by doing so, you make his script/hack/spam-provention a little stronger…
Rather than add that hidden field to your TEMPLATES – add it to your processing.tmpl file (in the form)
I also took it one step further…
I have all comment forms with a hidden field that sends the cookie ID (used for both the hotscript script – and the restricted access post script) – I added a hidden field for that as well in the processing.tmpl file – and duplicated Burnigbird's code to deny anything without that "snoop" field (don't foget to change it something unique on your site) to also deny anything without a cookie. (The downfall for this, if you haven't noticed already – is that users that don't allow cookies can't comment)… well, at least it's better than registration before allowing comments!
If you need more info let me know – and I'll post it in the comments…
