My multi-user CMS has 30,000 active members, and over 300,000 pages, and every content page accepts comments without a captcha, even from from anonymous users.
My secret? It's my own software, and it's not worth hackers' time to write a bot or deploy a botnet for my one-of-a-kind website.
I've considered switching to Wordpress MU in the past. It's times like this that make all the extra work worth it.