At least that's what I initially thought. But after some more digging it seems that x and y are hard-coded to be 2 and 3, respectively.

I opened the registration page in 4 different browsers with different IP addresses (my own, my VPS, and a couple borrowed from Tor) and in all cases the "security" question was "What is 2 + 3?"

Unbelievable.