That is beside the point. It does not matter what Oxwall uses JS for. All I'm concerned about is that spam bots can't understand JS, so blocking user agents with no JS should do the trick.

However, I recall something else that suggests this is a bad idea. Google bot could not parse JS till very recently, and I doubt it even has the ability to the fullest extent even now. Same story with the other search engine bots, or something some innocent developer builds somewhere. It would be inconvenient to compile and maintain a whitelist. Spam bots are just one, though huge, subset of bots.

I must think of something else. The Anti Spammer plugin is useful and does an admirable job, but it is far from an ideal and full solution.