There's loads of different methods, though they cannot recognize the letters, that much I am sure of.
One of the most common methods is to send the captcha to another website of theirs, be it a porn website, an illegal download website, one of the websites they are advertising, or anything like that, and letting the human who visited that website do the captcha for them. Sadly, there is no real way to prevent that, and before anyone gets their hopes up, while 2.0 has many features that will reduce bots, don't expect to see them gone unless you are willing to accept my hard-on idea which I proposed before: requiring the first post to be approved by a moderator or administrator.
