Hey there.
The way you're calling both the image file and the corresponding text file precisely the same name got me thinking: isn't that a very bad idea? It would be incredibly simple for a spambot to simply copy the image URL and exchange the .png with .txt and thus gain access to virtually every CAPTCHA you create with this plugin. Not a good idea, in my opinion.