Your concern is somewhat valid although if someone is making 30 plus attempts to submit a form can we not assume it is a bot? We have made a configuration interface to allow users to increase the number of possible response photos if they are security paranoid.