Very nice list of countermeasures. I agree that doing these small things like hidden input fields really go a long way.
I would add to that:
- block signups/comments from known throwaway email domains
- block known datacenter IP ranges, at least for POST requests. Honestly on our sites 50% of spam was coming from AWS EC2 IPs
- use a proxy/vpn/bot detection service like https://focsec.com