Note that a couple of researchers at Rice University have released a Trackback spam blocker plugin which uses a different approach: their Trackback Validator Plugin checks to make sure that the sites which send you Trackback pings really do link to you, a test that most Trackback spammers fail.
A clarification for people who are as confused as I’ve been, if I’ve got this right:
TrackBack doesn’t have to be manual. It has a well-defined method for auto-discovery of TrackBack URLs. However, at this time WordPress doesn’t implement TrackBack’s auto-discovery protocol.
That has led to lots of misleading statements like “PingBack is automatic while TrackBack is manual”: that’s true in a WordPress context but not in general.
At least I think that’s the case. Please correct me if I’m wrong!