Before worrying about .htaccess stuff why not stick to the basics? For example you have referers on your stats page that have been in the antispam database for a long long time.

Update your antispam table several times until you only get one update that is 'already done'. That won't clear your hitlog table, but it will stop them from registering more hits. If you feel like hacking into the code a bit follow my "antispam rechecker" hack to clean up your existing hitlog table. Part 3 is where most people go, but you kinda need to read through [url=http://wonderwinds.com/hackblog.php/2005/01/29/antispam_recheck_tool]Part1[/url] and [url=http://wonderwinds.com/hackblog.php/2005/01/30/antispam_recheck_tool_part2]Part2[/url] to make sense out of [url=http://wonderwinds.com/hackblog.php/2005/02/07/antispam_recheck_tool_part3]Part3[/url]

To really cut the bandwidth damage [url=http://forums.b2evolution.net/viewtopic.php?t=4512]check out this post[/url] and do like it says. You can do this one without bothering with my rechecking hack, but the rechecker just makes things easier to manage.

Finally, since your stats page is not linked on your blog, just rename (or delete I guess) the skins/skinname/_stats.php file. Spammers won't be able to see if they score a hit, and that makes some of them go away.

You can also read the [url=http://forums.b2evolution.net/viewtopic.php?p=23293#23293]spam: an IP based approach[/url] thread to block some spammers.

My website http://orderweb.co.za/blogs is under constant 'refer spam' attack
In 3 days 50% of my monthly allocated bandwith has been consumed !
This is a serious problem when you pay for extra bandwidth consumed
Daily I get 57,000 hits, 99% from spammer

The solution to beat this spammer madman is simple

move your /blogs folder to /nospam/blogs

create /blogs/.htaccess file and add

order deny,allow
Redirect / /nospam

spammer will recieve 302 error code
Real browser will go automatically to new url !

If spammer figures out what is happening then move to /nospam2 folder and so on

:>

Also, make sure you're running version 0.9.1. It does a lot to reduce the amount of bandwidth that spammers use.