While messing around with your files can be a good deterrent, updating your CMS could mess it up. I’d rather use a bunch of anti-spam modules e.g. Askimet, BadBehaviour, NoCaptcha, etc. or instead put up a very simple captcha or sum to work out.

Not every search engine uses nofollow, and it is somewhat hated by a bunch of people, for example Wikipedia has nofollow now. Yet if your site was good enough to have a Wikipedia reference, you would hate that reference being worth nothing!