Have you thought about adding a proof of work challenge? Your bandwidth is spared and attackers get increasingly expensive computational puzzles.

Disclosure: I work for Friendly Captcha, which uses the above strategy.