I get a fair amount of spam on this site; less than most, but significant enough to be a problem. Most of it is trackback spam which, by design, isn't an easy thing to combat, but Drupal does a decent job of things.

Comment spam, on the other hand, has been giving me a headache or two, and not in the way that you think. You see, Drupal does catch most if not all of it, but it also overzealously picks up real people's comments (and as you can no doubt see, I have far too few of those as it is!), just like my last CMS, Pivot.