This is called a honeypot field. Basically spam bots are stupid and try to fill in every field (especially ones with phone, email, website, etc in the name). The honeypot is a hidden field that if filled out causes the form to not submit completely. There are some plugins for Wordpress that handle this for contact forms (Contact Form 7) and for comment forms. If you search Honeypot from the WordPress plugin directory, you will find them.

Also, many spammers hit the wp-comments-post.php file directly. Since they hit it directly there is no referrer passed like there would be if a POST was sent to it from a page on your site. This page: http://goo.gl/n5VHm on WordPress.com has information on code that can be added to your .htaccess file that will crush bots that POST to wp-comments-post.php with no referrer present.