Captchas aren't even effective against fraud.

I think you missed my sketch of how the attack against single-use URLs (or, for that matter, pages that show what the last IP address to access the account was) works.