Okay, two techniques, one that’s going to be comprimised sooner, one that’s going to be compromised later:

1. A hidden field that must be supplied
2. A javascript client-server MD5 oneway hash

I don’t see the second as a viable solution because it demands javascript (precluding certain users), and the first will be bested by the spammers when it becomes economically viable. I guess it depends on the implementation cost as to if it’s adopted here.