These are the general options available within wordpress:



Names and keywords can also be blacklisted natively but IP addresses cannot be.

There are other plug-ins which can blacklist IP addresses or usernames but, IME, those don't show the user that it is held for moderation; they just get dropped.

It is also possible that some combination of the words used tripped up the anti-spam filter. I found one of those today in my queue and I have no idea what made that trigger but it did. Not all the bloggers bother examining the spam queue very closely as, depending on the blog, it can be hundreds to thousands of messages daily.