[ryacko]

Spam is done by massive botnets that crawl the web at a rate nearly equal to Google's.

[AFNobody]

And they have their equivalents of Amazon's Mechanical TURK to learn how to bypass security questions.

https://2captcha.com/public_statistics <- this for example

You can find humans willing to work for $0.001/captcha.

[littlestymaar]

I've also read that some torrent or other illegal download website display captchas that are in fact captchas from other websites, to crowdsource the captcha bypass.

[AFNobody]

Correct. There is a long list of human farming options they employ.

They frequently use that one then "pretend" they have workers.