The property captcha.max.challenges states following
# Set the maximum number of captcha checks per portlet session. Set this
# value to 0 to always check. Set this value to a number less than 0 to
# never check. Unauthenticated users will always be checked on every request
# if captcha checks is enabled.
How ever the logic does not match this explanation.