An email couldn't be generated with the files without using the page itself. You aren't using server validation to validate the CAPTCHA, so it can be ignored and emails will be sent. I think adding server validation and validating the CAPTCHA on this page will solve your issue.