the action of your form is to post to the formmail.php page
All form processing must occur on the forms action page
this means that you need to apply the validation for captcha and the security question to the formmail.php page
see this post for details:
showpost.php?p=105229&postcount=2