When you say "can you verify that captcha validation is catching bad security codes on the form?", did you mean to try entering a different code than what Captcha is requesting? I did that, and the form would not submit.
I don't think the form was being submitted manually, because they received those emails in such a short period of time.
Well, dang... I suppose the captcha screens out the majority of junk, but there's just no escaping people with too much time on their hands...