It seems the spam wasn’t a single pass, so I’ve had to turn on comments for registered users only. I’m sure there’s spam bot that will register itself out there too, but I don’t want to block comments yet - although why not, I don’t know, given that no one but spammers has commented yet.