Come to think of it, I've been using the following in robots.txt for several months:
Disallow: /wp-content/uploads/wpcf7_captcha/
The problem is -- it's not working, I think. I'm still seeing 404s from the captcha images. It's possible though that the problem is reduced from before, but I have no way to test it.