vidmalis:
CAPTCHA I using is TTF & GD v2.9, Zen Cart 1.3.8a, PHP Version: 5.2.17 , MySQL 5.0.92...
Downloaded from here: http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=551 , so is for my version of Zen Cart. Create account is set to "true"Boot is not able to create accounts(not happened). Yes, boot filling out reviews without creating account, and Product Reviews Require Approval" is set with a '1' for True, so only I can see reviews(burning my time to delete them) .Yes, store is set to showroom mode, I using it to my company MLM recruiting. I think to upgrade to 1.5, waiting to when testing will be finished...
OK, what's happening can/may be the result of another Add-On which could be interfering with the Captcha PHP Code. I can help you look for this, but I would also need to know, All Add-Ons which you have added to Zen-Cart.
There is another item that you should also consider looking at, and that is your .htaccess file, if the server your using, uses Apache Software. Blocking Bad Bots with .htaccess is very helpful in todays market. Should you need some help with adjusting that file in order to block bots, or others, I have provided the following Online Instructional links below.
For assistance in writing .htaccess code:
http://httpd.apache.org/docs/2.0/mod/mod_access.html#deny
http://www.ipdeny.com/
http://www.darrinward.com/blog/seo/bad-robots-prevention
http://www.electrictoolbox.com/apache-allow-deny-ip-address/
You will find that with Zen-Cart, and many Add-Ons, you will still need to add additional security coding to .htaccess to aid in putting a stop to hackers, and just plain nuisances. Which even if there are no conflicting code issues with other Add-Ons that you have in place, and if Captcha seems to be working correctly, without adding additional coding in .htaccess to block unwanted computers, or people, it can still be easy for them to get in, and be annoying.
I hope this helps to point you in the right direction to resolve the issue your having.