Interesting. I just noticed that I have a few comments sitting in the moderation app that are SPAM.
I had experimented with open public comments, but had changed the settings back once I learned how to use access tokens.
Will have to keep an eye on it. So far, its just one post that they have been commenting on. I can't remember if I made the post before or after changing the ability to comment back to "only those you allow", and channel setting back to "Mostly Public" from custom.