Thanks scjessey (and, on preview, Rudy).
Didn't think to try hitting the script directly...
I removed the echo statements and it is indeed working correctly now.
However, I was originally keeping the Captcha script in an include directory, outside document root, with all of my php require files:
img src="../devinclude/CaptchaSecurityImages.php" alt="wtf"
and that is still failing, showing the alt text
Is Apache not allowing this because it's outside of the document root? Is there a way around this?