The Spamna (=Spammer Node Add) module checks for users who have attempted to do a disallowed "node/add" and thus judges that they are spammers. Optionally it deletes the users found.
Running Spamna looks as follows:
Typical spammer page visits are as follows. Note in particular the attempt to do "node/add" which is denied. This is what Spamna uses to identify them as a spammer.