Heartbleed would not have anything to do with this.
On the forms that have server validation, make sure that the Server Validation comes before the UE code block./
also make sure that they both use the same trigger.
If the UE Code block uses the button press trigger, use the same button press trigger for the validation.
Server validation will only prevent automated spam, it will not prevent a person from filling in the form with spam.