I had gated comments on my website www.beerstainedletter.com and as such users would have to deal with captcha and my moderating them before any would go up on the site.

Yet my database became filled with comments, enough that things exceeded the 1 GB my hosting company allots for database. The hosting company steered me to the problem 1 GB of clutter/spamlike junk links etc under K2 Comments (I've since cleared out the database of the 1 GB of comments and turned off the comment option on the site).

So my question is: How could this be happening? Is there some hole that these spammers are exploiting that I should be damming up?

Thanks in advance.

Even with recaptcha enabled there is still a risk in any kind of form, not only K2 comments form, for spammers to act. You should enable Akismet as well as an extra measure to avoid spamming in your K2 comments form or enable the comments for registered users only if you want to narrow it more down.