As it turns out, the problem was that some evil spammer had used a script to insert a bunch of comments all at once into the database before the spam protection was added. These are comments associated with postIDs that did not yet exist, so when a post was created that happened to have the same postID a nice fresh comment from the spammer was waiting for it (as detailed at
So I’ve hacked all of the offending entries out of the database and added some code to prevent such a thing happening again.
Annoying. Very annoying.
There is a special place in hell reserved for spammers.