I am in the midst of updating the Top Commentators Widget, and have a few changes in mind for this:

1. Modifying commentator queries based on e-mail addresses instead of URLs. I have read a few posts currently in the Web about how Top Commentators plugin can be hijacked by spammers, by way of typing in legitimate site URLs of honest commentators in a particular blog, then possibly inserting the spamming URL in the content of a comment. The suggested fix to this issue is to do queries of top commentators based on e-mail addresses, which are hidden from comments (as is most often practiced).I have suggested a fix that does just that in one of the comments of the Top Commentators Widget, but I have not tested it extensively. I’ll be doing so before releasing the next version of this widget.
2. Fixing the unclickable form fields in the Control Form. There’s only one, really, that I have identified as problematic, and that is the “Specify number of days” field under the reset period. The problem is apparently caused by the label tag wrapping around both the reset period and reset day fields. I have redone that part in my current test.
3. Option to list only commentators with URLs.
4. Fix the exclude URLs field, which seems to not work the way it suppose to.
5. (Added 4/Mar/08) Option to display or not display comment count.
6. (Added 11/Mar/08) Option to set NoFollow on all links in the list.

There were a few more issues I would like to fix but which may be out of my control. For example, a few commented that changes were not reflected even when saved (this could be permissions issues or browser not refreshed after changes were applied), and the control form not showing at all (certain browsers can’t display the JavaScript-and-CSS-based form properly; you may want to try using a different browser just to make sure).

If you’re currently using the widget and have anything else to add before the update is released (probably end of March), please use the comment form in this post, instead of the widget home post, and I’ll see what I can do with the request.