I'd previously closed all comments on posts over 30 days old, across all 700 blogs on the installation, so I was dismayed to be getting comment spam still. How was it sneaking in? After looking through my logs for POST comments I pulled out a bunch of likely looking pages.
grep wp-comments-post access.log
OK so it seemed that although all the WP Posts were locked down, some Pages and some Media posts were still not locked down — the 30 day expiry thing must only apply to Posts. Grrr. The internet revealed no easy way to fix this so I looked in the database and crafted a query which would do this for me on one table …
UPDATE `wp_1_posts` SET `comment_status` = "closed", `ping_status` = "closed" WHERE `post_modified` < "2013-10-31 11:59:59"