OK, So I've rushed ahead and rolled out Captcha for comments by anonymous users and tightened the existing spam filter (it unpublishes posts with more than n links or n repeated links, etc). I've also restricted creating new forum posts to registered users, but I'd like this to only be temporary.

Next week I'll roll out moderation and captcha for forums and we play with different levels of restrictiveness to see if we can cut the spam down without being too unfriendly...