captcha to submit an internal already authenticated request? That's a new low

You have no idea how many vulnerability checks and probes for comment forms go on strictly by scanning a list of server IP addresses. I spend at least two hours a day going through the logs of two different sites, adding baddies to an htaccess file that's already well over 280kB. Trust me when I say that having an invisible reCaptcha on all input forms helps a ton.