Apparently we were set up to require site registration to comment (and since we host our own site, the generic WordPress id didn’t work). For now I’ve turned that off, but I haven’t found the place to turn off comment moderation, so I suppose that’s the compromise. I don’t really expect much spam anyway.