For WordPress, there is a plugin that automatically sets trackbacks to moderated. However, this plugin uses additional database accesses (sets the moderation flag after the creation of the trackback), which is rather annoying for trackback spammers - every additional database access increases the system load. Therefore, I wrote my own version of it, which does not require any additional database accesses. The source is available here.