First off, thanks for the plugin! It's been great until just the last few days. Now, I'm getting spam slipping by.
GASP is 1.5.2 and I've tried changing the checkbox name and enabling the secret key without any effect.
I do see the checkbox if I'm logged out and a quick test of normal form submission does require the checkbox to be ticked.
Apparently, there is some easy way around GASP the robots are using.
Server is running under nginx, in case that matters.
Here's a post you can check test against: