Ok, got it working with recaptcha, turns out it's quite easy.
Here are a few thoughts about this plugin:
Issue 1: Lost pass function doesn't check if a user with the typed address really exists. It sends the mail with a new pass even if there is no user with that email.
Issue 2: Lost pass is not really working, as it just updates the password field and not the salt field. I fixed it by simply emptying the salt in the query, so that Wolf falls back to the simple sha1 password encryption.
Issue 3: The template parts (on the settings page of the plugin) could use some kind of "template variables", for example the welcome message consists now 3 parts: header text + random key + footer text
// now it's like:
$message = $welcome_email_pt_head . $code_url . $welcome_email_pt_foot;
// I would do:
$message = str_replace('[confirm_url]', $code_url, $welcome_email_body);
Issue 4: I noticed that when I register with an email containing a "+", something goes wrong when confirming. The script creates a user with empty username and email, and it doesn't get deleted from the registered_users_tmp table.