Every web service that includes the CaptchaService should also provide some sort of API-Key (could even be created by the web service itself), that can be used to further improve the verification that the user really solved the Captcha by not only relying on the ip address.