Check that IP-number matches

I occasionally get spam user registrations. What they have in common (except that the user details follow a similar pattern with the full name for both given and family name and the domain of the e-mail address resolves to the same IP, 93.104.213.198) is that the trace in the weblog have an identical pattern, like

#Fields: date time cs-method cs-uri-stem cs-uri-query s-port c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-substatus sc-bytes cs-bytes time-taken
2011-04-30 05:39:23 GET /user/register - 80 24.56.121.196 HTTP/1.0 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.13)+Gecko/20101203+Firefox/3.6.13 - - 200 0 12491 331 3042
2011-04-30 05:40:25 GET /image_captcha/1662/1304141962 - 80 193.37.152.250 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.13)+Gecko/20101203+Firefox/3.6.13 SESScd035fb4a30028ff09f3d6dfbcd6aee3=hij50a1pgobs9vi0kkn2vpd471 http://grapestat.se/user/register 200 0 5884 381 499
2011-04-30 05:41:06 POST /user/register - 80 24.56.121.196 HTTP/1.0 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.13)+Gecko/20101203+Firefox/3.6.13 SESScd035fb4a30028ff09f3d6dfbcd6aee3=hij50a1pgobs9vi0kkn2vpd471 http://grapestat.se/user/register 302 0 535 889 2090
2011-04-30 05:41:27 GET / - 80 24.56.121.196 HTTP/1.0 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.13)+Gecko/20101203+Firefox/3.6.13 SESScd035fb4a30028ff09f3d6dfbcd6aee3=hij50a1pgobs9vi0kkn2vpd471 http://grapestat.se/user/register 200 0 22265 458 1263

One IP (in this case 24.56.121.196) gets the registration form, another IP (193.37.152.250, this appears to always be the same) gets the image CAPTCHA and sends a session cookie. The first IP then submits the form with the *same* session cookie and is not blocked by CAPTCHA.

I can only speculate on what is going on behind the scene but this does not look like normal user behavior to me. Checking that it is the same IP-number that responds to and requests the challenge should prevent this.