DeeCee - 1:38 am on Apr 7, 2012 (gmt 0)
I assume it was their base plugin code you reviewed at some point in time?
Akismet is a service based spam blocker (meaning that the plugin code is a mere local interface calling a remote API). Plugin code itself is mostly a mgmt interface).
The actual "blocking" is done by calling their servers, so to defeat it, you would have to defeat Wordpress itself (preventing incoming spam from even going trough any checks).
Defeating Wordpress from filtering its own comment spam would seem a whole different ball of wax. I have yet to see a spammer bot try to do that. All the spam (not hacker) bots I see pretend to be users and merely spam into Wordpress, in which case the plugin will be called. So I am not quite sure what "defeat" means in this case, since I assume that you do not have access to Automattic's proprietary server spam-algorithms.
I myself do not use and have never used Akismet, So I am not trying to defend their systems. Merely curious about the "defeat" part.