Thanks for your compliments.
One thing to note: Bad Behavior is not intended to be a
complete anti-spam solution;
it should not be the only thing you run. Bad Behavior should also not do certain things and indeed, a close inspection of the code will reveal quite a few things which have been either partially implemented, or tested and found to not work and therefore disabled.
Bad Behavior is meant to block a majority of obvious spam, in order to reduce server load and reduce the amount of spam messages and registrations to a level that is manageable with more traditional tools. Because this is done by completely blocking the request and stopping vBulletin (or other software) from completing loading, it's simply not possible for me to do everything. Some things must be let through because I can't reliably distinguish them in real time.
Bad Behavior is also not meant to be a general purpose blacklisting tool, as a few people here have tried to use it. While it does contain an internal blacklist, these items are limited to well known malicious user-agents which scrape, harvest addresses, deliver spam or execute attacks. Things like ht:track and wget are intentionally not on the blacklist because many people want such software to visit their sites, and they are not designed as malicious tools. It's better to add such things to your local .htaccess (or equivalent) if you intend to block them.
Perishable Press has some really good starting points.