My b2evolution Version: 1.10.x

One of my bloggers just got a piece of trackback spam that, on looking through the logs, appears to have been a direct call to trackback.php from outside the site.

Is there a way to block trackback.php from being called except locally? For example, I have this entry in my .htaccess for blocking comment_post.php to only be called locally:

RewriteCond %{HTTP_REFERER} !^http://www.mydomain.com/blogdirectory.*$ [NC]
RewriteCond %{REQUEST_URI} ^.*comment_post\.php$
RewriteRule .* - [F]

Is it safe to add a second block and replace comment_post.php with trackback.php ? Will that work?

[EDIT: The site already has reCaptcha running. They just went right around it]

jj.