Sorry to harp on about challenge/response, but on the topic of C/R causing many false positives, I just noticed this post on The Admin Zone:
I HATE challenge-response spam blocking with a passion. All the time, I get Earthlink members signing up on my message board, but not putting the domain name in their whitelist. When vBulletin sends out a validation email, the following bounces back into my mailbox ... As a matter of principle, the mods and I NEVER respond to email challenges; we NEVER "click the link below" to be added to a whitelist.
If an existing user starts using challenge-response spamblocking, forget to put my domain in their whitelist, subscribe to threads, and as a result fill my mailbox with challenges, they're suspended for a week. Behind spam, it is my number two pet peeve.