When I moderated a mid-sized forum, pretty much 90% of our spam had a URL in the first post, whereas normal users were pretty much the opposite.

It seemed like sending those direct to moderation would have removed a lot of the work. In the end we just moderated all first posts since it wasn't that much volume and I didn't want to modify the software myself.

Is your spam more complex? I've noticed that it seems to be getting fancier.