I’m having the same issue. I started getting things along the lines of “great theme. where did you get it?” with the obvious flags of being spam.
I suggest enabling full comment logging (on spamfree’s options page) and after you get a few comments that should have been blocked, submit the log to the developer.
It isn’t a reference to your anti-spam plugin. Your site has been injected with a “invisible” div containing spam links. Visit your homepage and view the source. Find the “body” tag. The injected code is right after the body tag. When the div is displayed, there is a full page of spam text with several links to similarly attacked webpages.
You will need to manually purge the code, then likely spend some time figuring out how the code got injected.
