We recently had a pen test of the application and one bit of feedback was that the applciation is prone to brute force login attacks and CAPTCHA should be implemented
Configuring account lockout policies on the user account source (LDAP, AD, etc) would largely solve this issue and should be in place anyway.
Plus I think if you required users to deal with CAPTCHA to submit a helpdesk ticket you'd have unhappy users fast.
We are providing the service for an external third party so the only client access is via username/password.
if not CAPTCHA then a more flexible lockout process for client logins could be an improvement