If you feed the images through a secondary script, you can scramble the file names so it won't be possible to match the letters that way. A more patient script can still do bit comparisons (run through the validation process a few hundred times, collect all the images, match the images to letters, then have your script match the data instead of the file names), but this requires more time and effort than most people are willing to put out, and the remaining few will be able to screw with your site regardless of how good its security is.