I worked on CAPTCHAs at Microsoft Research in a past life, and I can tell you, most original forms won't work. In the case of the one you described, I as an attacker can just put it through Tin Eye to find the original, and then do some semantic analysis on the page containing the image, or event just the URL, to figure it out. I have working code for this as a proof of concept for Microsoft's Kitten Auth.