Presume I'm a bad actor and want to do a naughty thing on a site protected by some 3rd party CAPTCHA solution. For instance, perhaps I'm a spammer who wants some way to script sign-ups to Hotmail.
Out of curiosity, I did some Googling. I found that there are indeed some providers who claim they can defeat CAPTCHAs, but interestingly these providers all seem to use humans to do the solving. (Basing this on the fact that they all offer a sign-up option for workers as well as clients.)
What is the defence mechanism against the sort of attack I've described?