Speaking of captchas, there are click workers (humans) who solve captchas for a living, even APIs so you the customer can get access to sites in almost real-time. A clever variation was re-displaying the captchas on porn websites and return the results.
There is a website right now re-selling Google Maps geocoding results for money. The coordinates are slightly altered but if you do 100 requests and take the average it will be what Google's service returns. I'm sure it's similar with Google translate.
Redirects like some-service.google.com/?do_something=1&.done=<spammer website> can be used to fool systems to think they're dealing with a safe Google.com URL.
We learned that for every mistake we introduce in software there will be somebody very bored or determined spending hours and days trying to abuse it.
I've seen 2k+ inbound messages/day put through a service that does this, versus the business paying ~$20-50/month for Twilio.