this seems plausible, yet there must've been thousands of attempts of people doing sql injections/looking at their logs?

if i remember correctly an error page leaked an ip in 2012/2013. someone had to realize the captcha was leaking at some point? consider me confused ;)