Hi Jordan,
I did a bit work on this lastnight (UK time).
The sending of emails when the captcha is wrong seems relatively easy to fix. It just needs the email code bringing into the clause for the security_code checking if-statement. To get it working correctly when the captcha is turned-off you also need to add a check for the captcha setting into this if-statement. Find attached my attempt at a patched version of easycontact.php.
easycontact.php
My other problem with the session variable being lost is more vexing. The CaptchaSecurityImages.php runs fine but on return to easycontact.php the security_code isn't set in $_SESSION. As I said this must be a configuration related problem because it works on one setup but not another. Still haven't worked out why!
At the moment I've got it working with a rather nasty hack which involves creating the security code in easycontact.php and passing it to CaptchaSecurityImages.php. As long as the $_SESSION['security_code'] isn't set in CaptchaSecurityImages.php in works fine.
Any suggestions as to the actual cause of the session problem would be much appreciated.