Suitably puzzled, I called up the head of BitDefenders anti-virus labs in Romania, Viorel Canja, who explained all. It turns out the Trojan creates free email accounts by copying each CAPTCHA and sending it off to another computer for processing. This process may be automatic, or may be done done manually. At the moment, it isn't clear.

[link|http://www.cs.cmu.edu/%7Ebiglou/|Luis Von Ahn] of Carnegie Mellon University - one of the people who invented the CAPTCHA test - thinks the process can only be manual. He notes out that creating 500 new accounts per hour hardly impressive. "If you think about it, a single human can get about 400 per hour if they just sit there typing," he told me. "Before CAPTCHA, bots could get more than two million accounts per day."

This seems to suggest that, should spammers ever work out how to beat CAPTCHA tests automatically, we'll really know about.