My donate form was also hijacked using the same method above. Hundreds of credit cards were run through our donation form. I second the desire for Captcha integration.
Well, I asked three questions, but you only answered the last one. No biggie, I’ll break the other two questions out into their own topics.