Currently the blacklist is only checking against the actual comment and not any of the other fields.
I would like to suggest, for future versions, that all comment fields (name, email, URL, comment, etc.) be tested against the blacklist contents when a comment is posted.
Have this as an option to preserve backwards compatibility with previous blacklists that assumed only the comment was being tested.
Comment spammers are beginning to catch on that comments are being checked (at least on my blog, anyway) and therefore put thier link in the URL field and it gets through the blacklist because the URL field is not tested against the blacklist. (All of my blacklist items are domain names of spammers as such: spamdomain.com, etc.)