For every user you'd have to know all usernames which could be brute forced guessed or gathered with some sort of crawler.

It's definitely a great point you bring up I think with web analytics an attacker has a natural advantage since captchas would obviously not be feasable. But it is worth to but effort in not making it too easy.

> Happy lunch!

Thanks :-) gonna start with my normal job now^^