I'm sure it's much more complicated than this, but off the cuff: You need a manual process to find cases like Penney's. Then, when you find a Penney's, you see all the sites linking to Penney's and they immediately become suspect. Not all of them will be selling links, but a lot will be. If you find a few Penney's's you start to build a spamrank(tm), narrowing in on sites that use stuff like TMX. You make outbound link weight inversely proportional to spamrank(tm, remember), and when you cross some line in your spamrank your outbound links become invisible altogether. Permanently. Additionally, the spamrank would add up like pagerank does on the target site and you make spamrank, say, 10x the weight of pagerank. You buy links, you get punished.
But it sounds like Google hates manual processes, they want to fix the algo. I don't see how that's possible without some crazy AI stuff going on (not that they couldn't go that route, mind you). Whereas I (a person) can look at a page and immediately say "link farm," doing that with a computer would likely be crazy difficult. Mostly because the best spam sites are legit sites, they just also sell links.
Speaking as a small business owner it's frustrating as hell. We've tried going to 'SEO' route, but A) there are a ton of super shady businesses out there selling this crap, and B) THIS IS NOT THE WAY IT SHOULD WORK. It's annoying when Blekko has us #1 for almost every related search term, but on google we don't even hit the first page for half of them. And if I take a handful of the people above us, scan their inbound links, the vast majority are all paid links. ARG. (Not that I think blekko has a better long term strategy, I think it's just as easily gamed, it just hasn't been... yet.)
I guess we just need to get as big as stackoverflow and complain, that way we can get customized changes. /END RANT