you might try farms anti-spam pack. Here's one of the threads about it with link to where can dl it in OP
http://mu.wordpress.org/forums/topic.php?id=5582&page&replies=26
You'll have to customize it in the php files (adding in words to list for captcha, spam keywords, etc) but works pretty well.
Also, I had a similar situation with one of my users. She was getting spam comments landing in her admin area awaiting moderation even though she had set her blog to no comments allowed. Turned out it was her blog entries I had imported from b2evolution. They were individually flagged to allow comments and it was overriding her 'no comments allowed' setting. Editing the settings for individual entries that had been imported fixed it.
So, might try having a look at the individual blog entries that the comments are being posted to and checking their individual settings.