A few years ago I put a feedback form on one of my websites and forgot all about it. Several weeks later I noticed the data usage on my server was being eaten up at an incredible rate. I tracked it down to the database which collected the feedback and found over 10,000 records ... all of which were spam and all of which were showing on one incredibly long and slow loading page.
These were in the days before Google's manual penalties but it shows how easy it can be for massive amounts of user generated spam to build up on your website in a very short period of time and quckly lead to a user generated spam penalty.
The most common places where this happens are:
Moderating user input takes a great deal of time but it is absolutely essential because for every one person who will create some genuine content there are one hundred or more spammers trying to build a link and one thousand spam robots trying to do the same.
Don't think that methods like CAPTCHA will be water tight, they are not effective against the teams of manual spammers who are hard at work.
Along with the penalty message Google will have given some sample pages where this spam is to be found which will guide you to where it, and possibly the rest of it, is.
Removing the spam is only part of the answer. In any reconsideration request Google will want to see what you have done to ensure the issue does not repeat itself so you will need to document the actions you have put in place. For example:
Remember while your site may have been penalised the URLs where spammers went will still be remembered by those spammers. They will not know about the penalty and will continue in their efforts to post spam on your site which will prove quickly if your new measures are effective or not.