One of the ways Askimet works is shared-secret-key authentication using your email address. Notice how sites collect your email address when you submit a comment but they don't usually publish it. However, they do send your email address to Askimet. As a result, we can get a fairly good approximation of whether a comment is spam or not simply by checking to see if the email address was used for comments previously flagged as spam or ham. The more non-spam comments--and especially the more ham comments--that the email address has in the corpus, the less likely it is that the new message is spam.

Now, imagine I am a spammer. I need to submit some automated comments that don't look like spam so that my spammy comments wll later get accepted. There are a variety of ways I can do this. The easiest is to give the user a generic compliment like "Wow, this was a great blog post! Thanks for publishing it." The comment doesn't add to the discussion but the blog owner is often reluctant to delete it because (a) it strokes his ego, (b) there is no way for him to tell if it is automatically generated or not. In fact, if his spam filter preemptively classified it as spam, he might even override the filter and reclassify it as ham; this would be a huge win for the spammer-to-be. Another way to do this is to automatically scrape a comment from another discussion about the page like Reddit, Digg, Twitter, or FriendFeed and submit it as a blog comment on the original page. A third way is to pay somebody a (very) small amount of money to read the blog post and write a comment (possibly using some fill-in-the-blanks response template system like those used in call centers.)

It works the other way too. If I want your comments to start getting flagged as spam then I should start submitting spam-like comments in your name. Then, users will start classifying my forged spam comments as spam and the automatic classifiers will start automatically classifying your valid comments as spam.