The regex in question could also be written as:
([0-9a-zA-Z]+-){2,}\S*\..{2,}

Meaning it will stop URLs that contain more than one hypenation, such as:

foo-bar-fubar.nu

Click on the url associated with my name for a list of some of the online and client regex testing/tutorial tools out there for free.

Since I don't know regexp that well - the person who you should probably bring that to the attention of is Jay - the author of the script itself. I keep a pretty close eye on the logs on the site - and I haven't seen any notable "false positives".

[ 0-9a-zA-Z ]+-[ 0-9a-zA-Z ]+-\ S* \..{ 2, }

This entry will cause a perfectly legitimate mail address like user+200402@spamprotect.example.com to fail.

This regexp alone caused two false positives in the last 25 comments of my blog - including a comment I had posted myself

I am writing this comment here because what I am about to tell you also has to do with comment spam. Im wondering if there is a way I could "prove" that I am the real owner of the site when I comment. For example, everyone can say that they are me, put in my email, site and its done, but only I would know a certain code to put or anything like that. It would be really cool that have that, so everyone is absolutely sure the owner is actually posting a comment.

I have seen alot of really popular sites that have this problem, but still no solution. I guess all of you scriptygoddesses could figure this out.

Just a little comment, is all.