Comments can be set to publish right away (the demo blog is set to this at the moment) or you can choose to moderate them first and also publish/unpublish/modify/delete comments as you see fit. There are some anti-spam measures already in place on comment and contact forms, but I plan on adding either captcha or security question option too. I'm leaning towards security question.