Nofollow attributes were added to the web in 2005, with major search engines and blog/CMS vendors providing support.
I find it interesting that it clearly hasn’t stopped comment spammers, who continue to bombard blogs. I can only assume they don’t care about Pagerank etc, but just want their links to be seen by humans, though I would have assumed most blog owners use spam detection of some kind, and most spam comments which do make it through are unlikely to get clicked on.
But that’s always been the issue with automated spam. Only a tiny number have to be acted upon to make them profitable.