Depending on your site's settings, comments display slightly differently from site to site. The basic comment form includes:
Name
Website
Comment
But I still get a lot of spam containing the website field; it seems like the bot is just automatically submitting POST requests with website included. This should be trivial to detect -- is there a plugin that just immediately deletes all of these out of hand before passing them on to an antispam tool?
If it's a bot sending POST requests, there's a high chance a "Website:" field would be filled out. Innocent users will not be able to fill out the field, in the case of a legitimate comment.
Also, many spammers hit the wp-comments-post.php file directly. Since they hit it directly there is no referrer passed like there would be if a POST was sent to it from a page on your site. This page: http://goo.gl/n5VHm on WordPress.com has information on code that can be added to your .htaccess file that will crush bots that POST to wp-comments-post.php with no referrer present.