Fixed it!

As it turns out, the problem was that some evil spammer had used a script to insert a bunch of comments all at once into the database before the spam protection was added. These are comments associated with postIDs that did not yet exist, so when a post was created that happened to have the same postID a nice fresh comment from the spammer was waiting for it (as detailed at
http://tamba2.org.uk/wordpress/spam/#imm
)

So I’ve hacked all of the offending entries out of the database and added some code to prevent such a thing happening again.

Annoying. Very annoying.

There is a special place in hell reserved for spammers.