ah we've had some clever spammers inject code into messages that forward you automatically on page load before too. we get hit quite often by spammers. usually we catch them after a few posts & then it's as simple as deleting their accounts which also removes all of their replies & any threads that they have created.
Can you screenshot one of the captchas for me? I've not seen it myself.
Unfortunately I got not hacking skills, or I'll put those knowledges into lua scripting.
After 10 posts I don't have anymore captchas, but you can try yourself, make a new account and try to post threads, you'll curse as never before.
Imperator
Forum Fan