Basically the referer check tries to make sure addpost is being called from the newpost/newreply script on your server. A true spammer wouldn't actually fill out the newpost/newreply forms. They'd look and see what fields are necessary to pass to the addpost script and write their own spam script that would just pass those variables totally bypassing the forms.
Normally, when a user is browsing your forum, each request they make comes with a referer variable that shows where they are coming from. A common script kiddie might try and write a spam script but not know how to spoof the referer variable, so that would spoil their attempt. Someone that has a bit more knowledge would know how to do it properly, so it wouldn't stop them. That's why I say it's not foolproof. It prevents the boneheads from spamming, but not the smart ones
