From the codex:
Comment author must have a previously approved comment - Check the box to insure comments are only posted if the comment author's email address matches the address of a previously approved comment, otherwise, the comment is held for moderation. Comments from blacklisted email addresses (those listed in the Local Spam Words Text Box) are held for moderation regardless of whitelist status.
Comment moderation used to be enabled on my blog, then I turned it off for many months, and now I'm turning it back on -- and observing some people's comments are appearing without my being asked to approve. I'm guessing there's a table somewhere that holds this old information. How can I reset wherever the stored values are so moderation is truly moderation? Thanks!