can you verify that captcha validation is catching bad security codes on the form?
if the captcha is catching a bad security code, a site visitor could not disable it.
captcha will not prevent all spam from getting through.
there are some automated tools available that can read the security code on the screen to bypass captcha, it is also possible that human being is doing the job manually.