[puzzle]

What prevents a botnet from sharing that same session cookie?

[Dylan16807]

A botnet doesn't need Tor in the first place. And you can limit the use of a single captcha solution. It's not much different from the problem of a legitimate google account being borrowed by a bot.