Was wondering how I ended up with hundreds of spam posts on my forum this week and how CAPTCHA had turned itself off, now I know...
I need the CAPTCHA turned on and the theme needs to work with it on the password reset page. The fix is sorting out the theme so the reset form works properly, turning off CAPTCHA isn't the answer (!)
Edit: having changed settings to "Use System" on the password reset feature it now seems to be working, this is now resolved.