Lately, some of our clients have had some trouble with report mail spam. When tracing this back, report.php and captcha/refresh were hit alot. My guess is that someone is trying to force errors on our environment (since there is a corebug that triggers an error when captcha/refresh does not receive a form id and report.php well.. yeah :)). Does anyone have an idea why people would try this and how to stop this? Requests have all been made trough Tor.
This could be any automated script run by any users who encounters it. It might not be even specific for your website but can target some random Magento shops.
You should think about putting a WAF (Web Application Firewall) in place that blocks specific requests (for example > POST 10 requests per IP within a certain amount of time). A good hosting provider will be able to investigate and help you with this.
I had the same problem lately.
I detected that googlebot had an error while crawling my website with /captcha/refresh error. I also found out that my captcha was missing while registering.
I searched for the error but could not find any relevant answer.
Finally I read this conversation and I started to find all users who tried to link to my page. Finally thanks to google webmaster tool, I identified the external link, two of them who were linking to my customer/account and wishlist page. You can find it in google webmaster search traffic, links to my page.
I went to my admin area, cpanel and blocked these two domains. After which I found that my captcha was working well as well as my /captcha/refresh page. Thanks for this article that made me think like this.