I would keep an eye on it. The captcha will stop the automated stuff. But, if they are sending more than one at a time, it could be that your form is allowing input into fields it shouldn’t, like email headers. So, it may still be insecure.
I don’t know enough to help more. I’m just saying it sounds like there may be an issue beyond the captcha, since they were able to add things they shouldn’t be able to add.