captcha validation is in place to prevent automated scripts from filling in the form and sending spam.
it cannot prevent a malicious person form filling in the form and sending the spam though. not all spam is sent by the same method. It is not really possible to prevent a person from filling in the form manually with spam content.