[rixed]

Couldn't the content of that cookie be used to validate its actual age? Like, just signing the date of generation?

[immibis]

That's probably what it was. So they accessed some page over and over, pretending to not have the cookie yet, got a bunch of cookies, and 9 days later, used them to bypass captchas.

[gruez]

...or generate a bunch and wait 9 days?