The method they describe is the first one that popped in my head when I was thinking about this. 
I don't think I'd have figured out the hostname spoofing they mentioned though, that was quite clever.
This one would be much harder than any of their previous ones (purely image captchas tend to be simpler). I'd prefer if they just keep it to user profiles and anywhere else they currently have it rather than in areas we use for our programs like shops or games etc. The main reason I can't see them adding it for main shops right now is because it would mean them sending data to Google and handling the response every time somebody attempted a captcha and, given their servers can't handle a bit of lookup scraping, that might not go too well.
I have to agree, they took a good solution and implemented it poorly. They should've made the captchas site wide but require it based on the player's activity. Only one or two requests a minute under the account/ip address, about one captcha a day. Only 10 or so requests per minute, about one captcha every few hours. More than 60 requests in a minute, just place a ten minute ban on the account/ip address.
It is almost insulting that TNT can't figure out light-weight but effective solutions to bots.
