spam from non-registered source

Hi,

My WP blog is a low key site and does not get a lot of visitors (not intended to be). However, I got a spamcomment that was posted without the user being logged in or even registered. Settings are for users to be logged in before they can comment and to have at least one approved comment before they can reply unmoderated. This spam was published without being held for moderation and the poster never registered. The IP of the spammer was not found in the visitors logs (no activity on my blog 30min before/after the posting.
Any ideas how they do this and better, how to avoid this?
I didn’t have Askimet activated but have now.

Thanks for any input on this.
Maurice.