I'm sure this is going to keep happening for a while, but hey, more broken stuff!
Commenting was broken unless logged in with a user account, and since the only one with such an account is me, that meant nobody could comment. An endless feedback of captchas was there as a very specific circle of hell apparently designed for trolls. If only it could be deployed just for them.
It's gone now. New anti-spam code in place, but will it work? Probably not, but it won't keep commenters out either. Since I do not trust this code to actually block spam, the moderator function remains on. Comments will go through now, but not show up until I approve them. Damn spambots.
Two minutes later...
Damn, those bots work fast! Russian spam almost immediately. This is gonna be a long-term issue, isn't it.
Two days later...
Found a new method that seems to be way more effective and turned off the moderation function. We'll see how it goes.