It does an actual text comparison to find a match with the CAPTCHA and security question.
However, that validation takes place on the server and not in client side code, for security reasons the answer never appears on the page even in script.
You should see a "Server Validation" server behavior on the form action page before the Universal email. It sounds like server validation isn't working properly, so I'd like to see a sample page that doesn't work to analyze what is going wrong.