I have a user on my site who is receiving spam comments to his blog. The comment notification/moderation e-mails to him do not include the e-mail address of the user, even though the blog is set to disallow comments that do not include an e-mail address.
I have tested it myself, and I receive an error message from WP—Error: please fill the required fields (name, email).
How are these comments getting through without an e-mail address? It's hard to blacklist a spammer without information on which to base the blacklist. :)