Yes, some spammers get in regardless.
I've added [url* and [img* to my spam phrases and set it to filter the first several posts of each user. The spam that actually doesn't get caught up in the moderated queue now is virtually nonexistent. Maybe a post every 2 weeks, and it's usually a human spammer who actually made a bunch of normal looking posts before starting to spam.