I wonder whether or not there are mechanisms other than captcha that prevent a mallicious script from creating an indefinite number of accounts for a given service. If so, is this not a huge red flag, especially with image analysis algorithms constantly improving?
Prominent web services use second level confirmation to screen and obfuscated automated spam registration, to increase the cost of automated spam. E.g.:
- email with a unique confirmation link
- email with a confirmation code that required user to click on a sperate link given.
The mechanisms vary between site. Captcha isn't just image of letters, Google's ReCaptcha doesn't show anything other than a tick box (you can google how that works).
The different mechanisms therefore are site dependent. A developer may require admins to approve accounts, restrict accounts to be created only after email validation, or number of accounts from an IP etc... there is no one answer for a question like this.
But in direct response to your question yes more can be done than just a captcha.