This is a good example of the pitfalls of CAPTCHA design. A bot that knows nothing about this site won't be able to get past it, but a determined attacker who for whatever reason wanted to spam this site could just pick a random square, or parse the board and use existing chess libraries to just break the CAPTCHA outright. Any success rate significantly greater than zero is all a spammer needs to succeed.