Sure, but the point of a CAPTCHA is to <i>pre-emptively</i> detect the user as a human or computer. Waiting until the account sends a boat-load of spam, and then saying &#x27;must&#x27;ve been a computer, let&#x27;s disable the account&#x27; does nothing - the culprit has accomplished their task, and moved on. We want to be able to prevent the spam from being sent in the first place, somehow, and determining if it&#x27;s a real human opening the account is (was?) a very good check.