I used a time based token for all my forms. The token becomes invalid after an hour or so. Enough time for legitimate users to post their stuff but completely blocks automatic spam.