I have made no progress on this issue, except to realize that I should point out to you that the answers to all Hot Potatoes questions are hidden right there in the page source code - you can use your browser "View source" functionality to see it. Therefore, perhaps you are expecting the Hot Potatoes exercises to be more secure than they actually are. For watertight security, I suggest you use the Quiz module. The Hot Potatoes exercises are intended more for experimental learning, than for knowledge testing.
Hopefully, I will get round to fixing the performance of the review option in due course.