AS JUSTIN MASON suggests, "It’s time we all agreed that the ‘nofollow’ tag has been a complete failure." Mason explains that "nofollow is a tag that blogs can add to hyperlinks in blog comments. The tag tells Google not to use that link in calculating the PageRank for the linked site." It is not working for this blog because comment spammers don't read words, they simply follow actions. And as long as they can make links, people will follow those links to spam-heavy destinations.
I remove one spam comment for every 2500 visitors--that's one manual deletion every other day. Six Apart catches spam upstream of my blog and deals with unwanted commentators electronically. Importantly, I don't even know it's happening.
Here's good advice from Justin Mason. "The key is to not use the same measures as everyone else — if every weblog has a different set of protocols, with different form fields asking different simple questions, the only spammers that can beat that are the ones that write custom code for your site — or use human operators sitting down to an IE window."
Justin Mason -- "Blog spam and a 'no-follow' post-mortem"