Captcha does not prevent a person form visiting the form and submitting a spam email manually, it really on prevents automated scripts from sending spam emails.
double check the trigger used for the Email and for the Server Validations, make sure they are the same, if they are not the same, it may be possible to by pass the Captcha validation and send the email.