Bases on #7 it should also support "%", "<%# %>", "<%%", "%%>", and "-%>".

Notice the XSS problems. See Wikipedia for an explanation on remote scripting.

Don't just allow comments for every URL but only for those from certain domains specified in a config file.

An input field that is moved of the screen using CSS. When it is filled in it's clear that it was a bot.

Set a cookie and remember the user that made a certain post.

Use http://www.naturaldocs.org/