How to add additional spam injection prevention to my forms? I think CAPTCHA protection is insufficient.

You can add additional spam injection protection to your forms by using a field that must be left empty for a successful submission. The nature of spam bots force them to fill out each form field. This is where we can outsmart them.

Just add a field to your form with the display:none CSS style:

And add following line to your form configuration in config.php file:

Users won't see this field and would never fill it. Even if user fills it under some weird circumstances, they would see an error message and will resubmit correctly. However bots can't read and understand this text and will stuck here.