Over at Code Project, Jeff Atwood, posted a rather neat article on a Captcha control. A Captcha is a way to help prove you're a human attempting to do something rather than a computer. There is are a few great articles on Human Interactive Proofs out there if you're interested in more reading.
Jeff talks about using HttpHandlers and HttpModules to do the image creation. He also gives a .Net 1.1 and 2.0 framework version. It includes a time out and even hides the actual text of the Captcha outside of the viewstate, since we all are aware the viewstate can easily be decoded.