According to Madd0's blog, most spammers on his site arrive with a blank (empty) user-agent string. He further proposes to add a redirection to the .htaccess file to redirect blank user-agent browsers to 404 page:

# BEGIN WordPress

RewriteEngine On

# Redirect empty user agents to Access denied
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule . - [F]

Link