Carbonize,
i have found maybe a possible workaround/solution..correct me plz if i'am wrong.
Because they get the addentry page automatic, i have changed the name to someting different. someting like addentry_**.php.
I also changed this in the config.inc.php, to kept everything working
I dont think its manual done...
Just checked my logs quick, and there where strange entries.
Without visiting the site, they GET the addentry.php page, and right after that (within 3 secs) the image.php page with this.
Same here..
After a month of no spam, this week they are back. (also on the Guestbook on this site i see)
Looks like they bypass the captcha input. At the moment i block every ip where it comes from, so if the are posting manual, this solves it in time..i hope.