First off, I'd like to say that spammers suck. My server gets hit plenty so that they get their poker, get your penis bigger, lose your debt ads on my referrer lists. I closed off all comments on my blog because of that garbage also.
So, I still want my stats up there so the solution I have is to put a login and password for the webstats. You can get to it using:
SMTP Stats: http://hld.ca/cgi-bin/mailgraph.cgi
IMAP/POP3 Stats: http://hld.ca/cgi-bin/couriergraph.cgi
Webserver Stats: http://stats.hld.ca/webalizer/